Unauthenticated conversation thread injection in FreeScout (CVE-2026-53591)

FreeScout's email ingestion command skips HMAC verification on the `In-Reply-To` header when the hash component is any length other than 16 characters, due to a backward-compatibility branch in `FetchEmails.php`. An unauthenticated attacker can exploit this by sending a single crafted email with a deliberately short hash, injecting arbitrary messages into any existing support conversation without credentials or prior access. The injected message appears as a legitimate customer reply in the agent UI, the conversation is reopened, and `last_reply_from` is set to the attacker's identity. Affected versions: - <1.8.223 We recommend updating to: 1.8.223. CVSS 8.6 · our assessment: this_week Reference: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-8vm3-wwq4-ggfx Details: https://vuln.today/cve/CVE-2026-53591