FreeScout’s reply and draft flows mistakenly trust attachment IDs supplied by the client. When a conversation’s attachment list is sent back to the server in the attachments_all[] field, the IDs that were not retained are decrypted and handed directly to Attachment::deleteByIds(). Because the function removes the database record and the physical file, a malicious user can repeatedly submit forged IDs to permanently delete attachments from a conversation.

Freescout, a PHP‑based help desk, is affected. Versions older than 1.8.215 are vulnerable, including the entire 1.8 series preceding that release.

The CVSS score of 7.1 reflects moderate risk. Exploitability is not yet quantified by EPSS, and the flaw is not listed in CISA’s KEV Catalog. An attacker who can send authenticated requests to the save_draft endpoint (i.e., a mailbox peer) can craft a payload that includes previously viewed attachment IDs, causing those files to be deleted. The attack requires no remote code execution or elevated privileges beyond the standard user level that can access the mailbox.