The vulnerability permits non‑folder conversations to reveal messages that are intended to be hidden only for assigned users. This leads to unauthorized disclosure of private chat records, affecting confidentiality of support interactions. The weakness is a misapplied confidentiality restriction attributable to CWE‑200.

Products impacted are FreeScout, the free self‑hosted help desk and shared mailbox solution, specifically versions prior to 1.8.215. Users deploying versions below this target are vulnerable.

The CVSS score of 4.3 indicates a medium severity. Exploitation requires ability to query non‑folder conversation lists, which is typically available to authenticated users. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can target the global search or AJAX filter paths to retrieve hidden conversations, thereby knowledge that should be restricted. The likely attack vector is inferred from the provided description, as the vulnerability statement specifies global search and AJAX filter paths.