A flaw in FreeScout allows a user with the PERM_EDIT_USERS permission to craft a single POST request that changes any other user's notification subscriptions, including those of administrators. This bypass of authorization control can cause admins to miss security alerts and assignment notifications, potentially delaying response to incidents. The weakness is classified as CWE‑863, an Authorization Bypass for User Data. No compromise of executables or data theft results directly, but the impact is a reduction of an admin’s situational awareness.

The issue affects installations of the FreeScout help‑desk software before version 1.8.217 from the vendor freescout-help-desk. The affected product is the entire FreeScout application, which may be running on a variety of PHP/Laravel environments. The vendor released a patch in the 1.8.217 release, which addresses the bug.

The CVSS score is 5.4, indicating moderate severity. No EPSS score is available, so the probability of exploitation cannot be quantified from public metrics. The vulnerability is not listed in CISA's KEV catalog, suggesting that no widespread exploitation has been reported yet. Attackers would first need to possess the PERM_EDIT_USERS permission, which should be restricted to trusted users; the attack vector is a crafted HTTP POST request, thus accessible to any authenticated user who has that permission. If a non‑admin account is granted this permission, they can silently disable an admin’s notifications, enabling a stealthy bypass of alerts.