FreeScout contains a mass assignment flaw in the mailbox connection settings endpoints. The controller methods receive the entire request payload and pass it to the mailbox model’s fill method without restricting fields. An authenticated administrator can inject values for security‑critical fields such as auto_bcc, out_server, out_password, signature, auto_reply_enabled, or auto_reply_message. When auto_bcc is set to an attacker’s address, every outgoing email from that mailbox silently BCCs the victim’s correspondence, and similar injections can redirect SMTP traffic, inject malicious content into signatures, or trigger auto replies. Thus the vulnerability enables covert exfiltration of email data and manipulation of outbound emails.

All installations of FreeScout before version 1.8.213 are affected. The product is FreeScout, a self‑hosted help desk and shared mailbox solution. Users running any older release must upgrade to 1.8.213 or a later version to remediate the flaw.

The CVSS score of 9 indicates a critical severity. Because a valid, authenticated admin session is required, the attack vector is internal and depends on privilege. The EPSS score is not available, so the current probability of exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. An attacker with administrative access can exploit the flaw with a simple HTTP request to the connection settings endpoint, making the impact immediate once authenticated. In multi‑admin environments, the attacker can silently and persistently exfiltrate mail traffic or alter outgoing communication. The absence of obvious detection means the breach can remain hidden until an unusual BCC is discovered.