Is FreeScout affected by CVE-2026-41190?

FreeScout versions with draft save functionality contain an authorization bypass vulnerability that allows low-privilege authenticated users to access and manipulate draft messages in conversations they should not have permission to view, creating a high-severity information disclosure and…

FreeScout CVE-2026-41190

EUVD-2026-24195 HIGH

Incorrect Authorization (CWE-863)

2026-04-21 [email protected]

Authentication Bypass

7.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:22 vuln.today

cvss_changed

Patch available

Apr 21, 2026 - 19:01 EUVD

Analysis Generated

Apr 21, 2026 - 17:37 vuln.today

DescriptionNVD

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The save_draft AJAX path is weaker. A direct POST can create a draft inside a conversation that is hidden in the UI. Version 1.8.215 fixes the vulnerability.

AnalysisAI

Authorization bypass in FreeScout's draft save functionality allows authenticated users with low privileges to create draft messages in conversations they should not access when APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS is enabled. While the conversation view correctly enforces access controls, the save_draft AJAX endpoint fails to validate user permissions, enabling unauthorized information disclosure and message manipulation (CVSS 7.1, High integrity impact). …

RemediationAI

Within 24 hours: Inventory all FreeScout deployments and document affected versions; notify helpdesk/support teams of the vulnerability scope. Within 7 days: Apply compensating controls (disable draft save if business process allows, or implement WAF rules blocking save_draft AJAX endpoints for low-privilege users); audit access logs for suspicious draft access patterns. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-41190 vulnerability details – vuln.today

Back