FreeScout allows a non‑admin user to permanently delete a private thread even after that user’s mailbox access has been revoked because the ThreadPolicy::delete authorization check does not verify current membership. The result is that an ex‑team member can erase notes they created, compromising the integrity of the help desk conversation history. This is an access‑control weakness (CWE‑862).

The issue affects FreeScout help‑desk installations, specifically versions prior to 1.8.221. All users with non‑admin roles who previously had mailbox access can exploit the flaw until the system is updated beyond this release.

The vulnerability scores a CVSS of 4.3, indicating moderate severity, with no EPSS score available and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated non‑admin account, making the attack vector local to the application. A attacker can trigger the deletion action through the normal user interface once they have logged in, provided they retain a deleted thread they originally created. No mention was made of a public exploitation vector or active exploits at this time.