What is the CVSS score of CVE-2026-47123?

CVE-2026-47123 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of FreeScout are affected by CVE-2026-47123?

FreeScout help desk versions prior to 1.8.220 contain an authentication bypass vulnerability (CVE-2026-47123) that allows remote attackers to forge support agent replies by spoofing email addresses.. A patch is available.

How to fix or mitigate CVE-2026-47123?

Within 24 hours: (1) Inventory all FreeScout deployments and document current versions, (2) Review customer support tickets for signs of message tampering or unusual agent responses, (3) Monitor FreeScout's official security advisory channels for patch availability. Within 7 days: (1) Preserve customer communication history for forensic review if compromise is suspected, (2) Implement email authentication standards (DMARC, DKIM, SPF) to prevent agent email address spoofing, (3) Prepare upgrade procedures for FreeScout 1.8.220 or later. Within 30 days: (1) Upgrade all FreeScout instances to version 1.8.220 or later when vendor releases patch, (2) If patch remains unavailable, deploy compensating controls.

FreeScout CVE-2026-47123

EUVD-2026-33440 HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-05-29 GitHub_M

Authentication Bypass Freescout

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 29, 2026 - 21:02 EUVD

Source Code Evidence Fetched

May 29, 2026 - 20:33 vuln.today

Analysis Generated

May 29, 2026 - 20:33 vuln.today

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two code paths for identifying agent (user) replies based on In-Reply-To / References headers. The notification reply path (notify-{thread_id}-{user_id}-...) extracts thread_id and user_id directly from the Message-ID without HMAC verification. An external attacker who can spoof the From address of a helpdesk agent can inject messages that FreeScout processes as legitimate agent replies - which are then automatically forwarded to customers via the legitimate SMTP server. This vulnerability is fixed in 1.8.220.

AnalysisAI

Authentication bypass in FreeScout help desk (versions prior to 1.8.220) allows remote attackers who can spoof an agent's email From address to inject forged replies into customer-facing threads. The FetchEmails command's notification reply path parsed thread_id and user_id directly from the Message-ID without HMAC verification, so spoofed messages were relayed to customers through the legitimate SMTP server. No public exploit identified at time of analysis, but the upstream commit publicly documents the exact missing hash check.

Technical ContextAI

FreeScout is a PHP/Laravel-based open-source help desk and shared inbox. The vulnerability resides in app/Console/Commands/FetchEmails.php, which inspects incoming In-Reply-To / References headers to correlate replies with existing conversations. Notification Message-IDs follow the format notify-{thread_id}-{user_id}-{timestamp}@domain, and prior to the fix the timestamp segment was not cryptographically bound to the thread, allowing the parser to trust attacker-controlled values. The class CWE-290 (Authentication Bypass by Spoofing) captures the root cause: identity was inferred from an unauthenticated, attacker-influenceable identifier (the email envelope plus a guessable Message-ID) rather than verified via the HMAC the patch introduces through MailHelper::getMessageIdHash().

RemediationAI

Vendor-released patch: upgrade to FreeScout 1.8.220 or later, which adds an HMAC hash segment to outbound notification Message-IDs (SendNotificationToUsers.php) and validates that hash on inbound replies in FetchEmails.php (commit d902f19038213c6a376947d269b00440908e88a0). The fix is intentionally non-backward-compatible: legacy 3-segment Message-IDs are rejected, so in-flight customer replies relying on the old format will be dropped - operators should patch during a low-volume window and monitor logs for 'Invalid hash in the Message-ID' errors. If immediate upgrade is not possible, compensating controls include enforcing SPF/DKIM/DMARC alignment on the inbound mailbox so spoofed From addresses are rejected before FetchEmails processes them, and restricting the mailbox to only accept mail from authenticated relays or trusted upstream MX servers; the trade-off is that strict DMARC may also reject legitimate forwarded mail and mailing-list traffic. Refer to the advisory at https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6r38-6mcf-2ww3 for full details.