FreeScout allows a user to send a GET request to the undo‑send endpoint for a conversation thread and, if the request is made within 15 seconds of sending a reply, the server will delete that reply. The access control check only verifies that the requester can view the parent conversation, not that the requester actually created the reply. This flaw, identified as CWE‑862, enables an agent in the same shared mailbox to recover another agent’s outbound message, thereby compromising message integrity and availability.

The vulnerability exists in FreeScout help‑desk versions prior to 1.8.214. All releases that include the shared mailbox feature and allow undo‑send operations are affected until the patch is applied. Update to FreeScout 1.8.214 or later to eliminate the flaw.

The CVSS score of 5.9 indicates moderate severity. The exploit is limited to agents who can view a conversation and must act within the 15‑second window, reducing the likelihood of successful attacks. No proof‑of‑concept exists in public advisories, and the vulnerability is not listed in the CISA KEV catalog. While the EPSS score is not available, the attack requires privileged access to the same mailbox, making exploitation less probable in environments with strict role segregation.