What is the CVSS score of CVE-2026-48811?

CVE-2026-48811 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-48811?

Yes, a patch is available for CVE-2026-48811. Update the affected software to the latest version immediately.

FreeScout CVE-2026-48811

EUVD-2026-33437 MEDIUM

Missing Authorization (CWE-862)

2026-05-29 GitHub_M

Authentication Bypass Freescout

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 29, 2026 - 21:02 EUVD

Analysis Generated

May 29, 2026 - 20:38 vuln.today

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note (private thread) from any conversation, even after that user's access to the mailbox containing the conversation has been revoked. The ThreadPolicy::delete authorization policy does not verify mailbox membership, so a former team member retains destructive write access to notes they created. This vulnerability is fixed in 1.8.221.

AnalysisAI

FreeScout's internal note deletion endpoint allows a low-privileged authenticated user to permanently destroy private thread notes in any conversation, bypassing mailbox membership checks entirely. The ThreadPolicy::delete authorization policy fails to verify whether the requesting user still belongs to the mailbox containing the targeted note - meaning a deprovisioned former team member with a still-active account can erase internal notes they previously created across any conversation. No public exploit has been identified at time of analysis, and this vulnerability is fixed in version 1.8.221.

Technical ContextAI

FreeScout is a self-hosted help desk application built on PHP's Laravel framework, using Laravel's policy-based authorization system to gate destructive actions. The affected component is ThreadPolicy::delete, a Laravel authorization policy that governs who may delete a thread (internal note). CWE-862 (Missing Authorization) applies here: the policy omits a critical mailbox-membership verification step, meaning the access control check is incomplete. The policy likely confirms that a user owns or created the note, but does not cross-check whether the user's association with the parent mailbox remains active. The affected CPE is cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:*, covering all versions prior to 1.8.221.

RemediationAI

The primary fix is to upgrade FreeScout to version 1.8.221 or later, which corrects the ThreadPolicy::delete authorization policy to include mailbox-membership verification. The vendor-released patch is confirmed at version 1.8.221 per the GitHub security advisory at https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9vx8-gx3p-9mh6. As an immediate compensating control prior to patching, administrators should audit and fully revoke FreeScout user accounts (not just mailbox memberships) for any departed team members, since the flaw persists only when a former member's account remains active. Note that revoking mailbox access alone is insufficient as a workaround - the account itself must be disabled or deleted to fully block exploitation.