FreeScout versions prior to 1.8.214 allow a low‑privileged agent to forge a request to the conversation_change_customer endpoint and bind a conversation to a customer that is not visible in the agent’s mailbox, effectively bypassing mailbox‑level access controls. The flaw is a classic authorization bypass where an attacker can associate data with a different mailbox, enabling unauthorized access to customer information. The CVSS score of 7.1 indicates a medium to high severity risk to confidentiality and integrity of customer data.

The affected product is FreeScout, the open‑source help‑desk and shared inbox application built on Laravel. The issue exists in all releases prior to version 1.8.214; upgrading to 1.8.214 or newer patches the vulnerability.

The vulnerability is exploitable via the standard web interface; a malicious agent with low privileges can send a crafted HTTP request containing any customer_email. The EPSS score is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting an arbitrary exploitation probability but still significant due to the nature of the control bypass. The CVSS score of 7.1 reflects the potential for unauthorized data access across mailboxes.