What is the CVSS score of EUVD-2026-24221?

EUVD-2026-24221 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of FreeScout are affected by EUVD-2026-24221?

FreeScout versions before 1.8.215 allow authenticated mailbox users to delete arbitrary conversation attachments belonging to other users through API manipulation, enabling data destruction and…. A patch is available.

How to fix or mitigate EUVD-2026-24221?

Within 24 hours: Identify all FreeScout instances and document current version numbers; restrict mailbox access to trusted administrators if possible. Within 7 days: Upgrade all FreeScout deployments to version 1.8.215 or later; test draft-saving and attachment workflows post-upgrade. Within 30 days: Audit mailbox access logs for suspicious draft-save API calls targeting attachment IDs; review user roles and conversation permissions to enforce principle of least privilege.

FreeScout EUVD-2026-24221

| CVE-2026-41192 HIGH

Missing Authorization (CWE-862)

2026-04-21 GitHub_M

Authentication Bypass Freescout

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:22 vuln.today

cvss_changed

Patch released

Apr 22, 2026 - 21:10 nvd

Patch available

Apr 21, 2026 - 19:01 EUVD

Analysis Generated

Apr 21, 2026 - 18:48 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 17:45 euvd

EUVD-2026-24221

Analysis Generated

Apr 21, 2026 - 17:45 vuln.today

CVE Published

Apr 21, 2026 - 17:12 nvd

HIGH 7.1

DescriptionGitHub Advisory

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs. Any IDs present in attachments_all[] but omitted from retained lists are decrypted and passed directly to Attachment::deleteByIds(). Because load_attachments returns encrypted IDs for attachments on a visible conversation, a mailbox peer can replay those IDs through save_draft and delete the original attachment row and file. Version 1.8.215 fixes the vulnerability.

AnalysisAI

Authenticated mailbox users can delete arbitrary conversation attachments in FreeScout versions prior to 1.8.215 by replaying encrypted attachment IDs through the draft-saving API. The vulnerability exploits insufficient authorization checks in the reply/draft workflows, allowing peers with legitimate conversation access to extract encrypted attachment IDs via load_attachments, then submit those IDs through save_draft to trigger deletion of attachments they should not control. With CVSS 7.1 (AV:N/AC:L/PR:L) and EPSS data unavailable, risk depends heavily on whether attackers have mailbox credentials and access to shared conversations. GitHub commit 5f182818e confirms the fix validates attachment ownership before deletion.

Technical ContextAI

FreeScout is an open-source PHP-based help desk and shared mailbox application (cpe:2.3:a:freescout-help-desk:freescout). The vulnerability stems from CWE-862 (Missing Authorization) in the attachment management subsystem. The application encrypts attachment IDs before sending them to clients, but the reply and draft-saving endpoints (save_draft) perform decryption without verifying that the submitting user has authorization to modify those specific attachments. When a user saves a draft and omits attachment IDs from retained lists (attachments_all[] parameter), the backend interprets omitted IDs as deletion requests and passes them to Attachment::deleteByIds() without ownership validation. An authenticated user who can view any conversation can call load_attachments to obtain encrypted IDs for all attachments in that conversation, then replay those IDs through their own draft operations to trigger unauthorized deletions. The encryption of IDs provides no security boundary here since any legitimate user can obtain valid encrypted tokens for visible attachments.

RemediationAI

Upgrade to FreeScout version 1.8.215 or later, released at https://github.com/freescout-help-desk/freescout/releases/tag/1.8.215. The fix commit (5f182818e2391f8e711fec6ae6648ac0b367bef5 at https://github.com/freescout-help-desk/freescout/commit/5f182818e2391f8e711fec6ae6648ac0b367bef5) implements authorization validation before attachment deletion operations. For systems unable to upgrade immediately, implement network-level access restrictions limiting mailbox access to trusted users only, and audit user permissions to minimize the number of accounts with mailbox access (reducing attack surface). Enable application logging to monitor attachment deletion events and investigate anomalous bulk deletion patterns. Note that restricting draft-saving functionality would break core application features, so access control hardening is the only viable short-term mitigation until patching. Review recent attachment deletion logs for unauthorized activity if exploitation is suspected.