An authentication‑based access‑control flaw in FreeScout’s ThreadPolicy::edit() allows any logged‑in user to view and edit every thread message, regardless of mailbox or role permissions. The vulnerability permits attackers to alter or remove customer communications, compromising data integrity and potentially creating compliance failures.

FreeScout help desk versions 1.8.208 and earlier, built on PHP’s Laravel framework, are impacted. Updating to version 1.8.209 or later removes the flaw.

The flaw is exploit‑able by any authenticated user; it does not require remote code execution or system privilege escalation. EPSS indicates an exploit probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog, yet the risk to privacy and regulatory compliance is elevated due to the sensitive nature of the compromised data.