FreeScout’s MailboxesController::updateSave() fails to filter the chat_start_new field from the allowed fields list. A user who has been granted only the mailbox signature permission can still submit a POST request to change chat_start_new, thereby altering anonymous or member‑initiated chat behaviors for the mailbox. This privilege escalation enables an attacker to change operational parameters of a shared mailbox without proper authorization, potentially disrupting customer support or altering privacy settings.

The vulnerability exists in all FreeScout help‑desk releases prior to 1.8.215, including 1.8.214 and earlier. The vendor, freescout-help-desk, released version 1.8.215 as a fix that removes the chat_start_new field from the allowed‑field filter for users with only the sig permission. Users running older FreeScout versions are therefore affected.

The CVSS score of 7.1 indicates a high severity due to the privilege escalation component and the ease of exploitation via a crafted POST request. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, implying no known active exploitation but still significant risk. Attackers can execute the exploit using any valid FreeScout user that has at least the mailbox signature permission, which is a relatively common role. The lack of additional access control makes the vulnerability straightforward for an authenticated user to leverage.