Description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, customer-thread editing is authorized through `ThreadPolicy::edit()`, which checks mailbox access but does not apply the assigned-only restriction from `ConversationPolicy`. A user who cannot view a conversation can still load and edit customer-authored threads inside it. Version 1.8.215 fixes the vulnerability.
Published: 2026-04-21
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality and integrity compromise through unauthorized editing of hidden customer threads
Action: Patch
AI Analysis

Impact

FreeScout allowed users who could not view a conversation to edit its customer-authored hidden threads because the edit policy omitted the assigned-only restriction. The flaw permits unauthorized manipulation of internal ticket details, undermining both confidentiality of sensitive customer information and integrity of the ticket data. The weakness is a policy enforcement failure affecting access control and is classified as CWE-863.

Affected Systems

FreeScout help desk software from freescout-help-desk. Versions released before 1.8.215 are affected. Users of earlier releases should verify their product version and apply the update if necessary.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in CISA KEV catalog. The likely attack vector is an authenticated web session where a user with mailbox access but lacking conversation view rights can submit edit requests targeting hidden threads. Exploitation requires no special environment beyond the affected FreeScout installation and an authenticated user account that meets the mailbox access criteria.

Generated by OpenCVE AI on April 21, 2026 at 22:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FreeScout to version 1.8.215 or later to apply the policy fix
  • Verify that the assignment-only restriction on conversations is enforced by attempting to edit a hidden thread as a non-assign user and confirming that the request is denied
  • Audit audit logs for unauthorized thread edit attempts and monitor for any unexpected changes to ticket content

Generated by OpenCVE AI on April 21, 2026 at 22:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Freescout Helpdesk
Freescout Helpdesk freescout
Vendors & Products Freescout Helpdesk
Freescout Helpdesk freescout
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Description FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, customer-thread editing is authorized through `ThreadPolicy::edit()`, which checks mailbox access but does not apply the assigned-only restriction from `ConversationPolicy`. A user who cannot view a conversation can still load and edit customer-authored threads inside it. Version 1.8.215 fixes the vulnerability.
Title FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'}

Subscriptions

Freescout Helpdesk Freescout
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-21T17:37:13.107Z

Reserved: 2026-04-18T02:51:52.972Z

Link: CVE-2026-41189

cve-icon Vulnrichment

Updated: 2026-04-21T17:37:07.939Z

cve-icon NVD

Status : Received

Published: 2026-04-21T17:16:57.367

Modified: 2026-04-21T17:16:57.367

Link: CVE-2026-41189

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T22:45:16Z

Weaknesses