FreeScout CVE-2026-41183

| EUVD-2026-24191 MEDIUM
Information Exposure (CWE-200)
2026-04-21 [email protected]
Information Disclosure
4.3
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Patch available
Apr 21, 2026 - 19:01 EUVD
Analysis Generated
Apr 21, 2026 - 17:38 vuln.today

DescriptionNVD

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.

AnalysisAI

FreeScout prior to version 1.8.215 leaks confidential help desk conversations to authenticated users through global search and AJAX filter endpoints, bypassing per-conversation access controls that should restrict visibility to assigned agents. An authenticated user with any level of helpdesk access can enumerate and view conversations they should not have permission to access via non-folder query builders, revealing sensitive customer and internal communication that the application explicitly restricts in folder views.

Sign in for full analysis, threat intelligence, and remediation guidance.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-41183 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy