FreeScout CVE-2026-41194

Exploitation requires: (1) victim mailbox administrator to be authenticated to FreeScout; (2) victim to visit attacker-controlled web content (email, forum, social media, advertisement, etc.) while maintaining an active FreeScout session in the same browser; (3) attacker to know or guess the mailbox ID ({id} parameter) and provider name ({provider}, e.g., 'gmail', 'outlook'). The {in_out} parameter distinguishes incoming vs. outgoing OAuth configuration. No special FreeScout configuration is required - the vulnerable route exists in default installations. The vulnerability does NOT require: admin to click a link (automatic on page load), social engineering beyond basic phishing/clickjacking, or authentication on the attacker's side. Mitigation factor: cross-browser same-site cookie policies (SameSite=Lax/Strict) in modern browsers may block the request if the session cookie is properly configured, reducing real-world exploitability relative to raw CVSS score.

CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) reflects moderate risk with network attack vector and low complexity, but critically depends on user interaction (UI:R) - a logged-in admin must visit attacker-controlled content. The lack of C (confidentiality) impact indicates no data leakage, while I (integrity) and A (availability) impacts represent OAuth configuration tampering and potential email synchronization failure. No EPSS or KEV status provided, suggesting limited public exploitation at time of report, though CSRF vulnerabilities are trivial to weaponize. The real-world risk is primarily to multi-mailbox deployments where admins regularly visit untrusted sites; single-user instances face lower threat if admins exercise basic browsing hygiene. The PR:N (no privilege required) in CVSS vector is somewhat misleading - the *target admin* must already be authenticated; unauthenticated attackers cannot trigger the action directly, only trick authenticated admins into doing so.

An attacker crafts a malicious webpage or injects a hidden image tag (<img src='https://target-freescout.com/mailbox/oauth-disconnect/42/in/gmail'>) into a forum post or email newsletter. When a FreeScout mailbox admin views the content while logged in, the GET request silently executes, disconnecting their Gmail OAuth integration. The admin may not immediately notice the disconnection; emails fail to sync until they manually re-authenticate, and during the downtime, incoming mail is not processed.