FreeScout’s mailbox OAuth disconnect is implemented as a GET route that removes stored OAuth metadata and then redirects. Because the endpoint lacks a CSRF token, an attacker can trigger the request cross‑site against a logged‑in mailbox administrator. The result is the mailbox’s OAuth credentials are deleted and the mailbox loses access to its external email service, causing loss of email flow for the help desk.

The vulnerability exists in freescout-help-desk:freescout versions issued before 1.8.215. Deployments of those releases that expose the GET /mailbox/oauth‑disconnect/{id}/{in_out}/{provider} endpoint are affected. Administrators should verify the running version and upgrade if it is out of date.

The flaw bears a CVSS score of 5.4, indicating moderate severity. No EPSS score is available and the issue is not listed in CISA’s KEV catalog, so publicly documented exploitation appears low. The attack vector is straightforward: a malicious site can embed a crafted link in a phishing email or malicious webpage that, when activated by an authenticated mailbox administrator, sends the GET request and forces the OAuth disconnect. The exploit requires only an authenticated session and no additional privileges.