FreeScout CVE-2026-41903

Exploitation requires the attacker to hold the PERM_EDIT_USERS permission within FreeScout. This permission is intended for general user-profile editing and may be assigned to supervisors, managers, or other non-admin roles. The attacker must identify the target user's ID (typically enumerable or visible in the user list) and send a POST request to the notification settings endpoint. No additional conditions, such as specific FreeScout configurations or enabled features, are required. Default FreeScout installations are vulnerable if any user is granted PERM_EDIT_USERS permission.

CVSS 5.4 (medium) with network-accessible attack vector (AV:N), low attack complexity (AC:L), and low privilege requirement (PR:L) indicates moderate real-world risk. The vulnerability requires prior authenticated access with a specific permission (PERM_EDIT_USERS), significantly narrowing the attacker pool compared to unauthenticated attacks. However, the integrity impact (I:L) and availability impact (A:L) are consequential: silencing admin notifications creates blind spots for security monitoring and incident response. This is not a data exfiltration risk but a notification suppression attack that degrades defensive visibility. The vulnerability's sibling relationship to CVE-2025-48472 suggests FreeScout's permission architecture has systemic weaknesses beyond this single endpoint. Organizations where user-management roles are distributed widely face higher real-world risk. Exploitation is trivial once access is obtained (single POST request, no complex exploitation steps), making this a priority for sites with distributed administrative functions.

An authenticated user with PERM_EDIT_USERS permission (e.g., a help desk supervisor authorized to edit user profiles) sends a POST request to the notification settings endpoint, specifying an admin user's ID and disabling their email and browser notifications. The request succeeds due to missing authorization checks on cross-user subscriptions. The admin continues working unaware that security alerts and ticket assignments are no longer being delivered, allowing malicious activity or missed critical tickets to go unnoticed.