What is the CVSS score of EUVD-2026-24225?

EUVD-2026-24225 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-24225?

Yes, a patch is available for EUVD-2026-24225. Update the affected software to the latest version immediately.

FreeScout EUVD-2026-24225

| CVE-2026-41194 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-21 GitHub_M

CSRF Freescout

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 22, 2026 - 21:08 nvd

Patch available

Apr 21, 2026 - 19:01 EUVD

Analysis Generated

Apr 21, 2026 - 18:49 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 17:45 euvd

EUVD-2026-24225

Analysis Generated

Apr 21, 2026 - 17:45 vuln.today

CVE Published

Apr 21, 2026 - 17:16 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the mailbox OAuth disconnect action is implemented as GET /mailbox/oauth-disconnect/{id}/{in_out}/{provider}. It removes stored OAuth metadata from the mailbox and then redirects. Because it is a GET route, no CSRF token is required and the action can be triggered cross-site against a logged-in mailbox admin. Version 1.8.215 fixes the vulnerability.

AnalysisAI

Cross-site request forgery (CSRF) in FreeScout prior to version 1.8.215 allows unauthenticated remote attackers to disconnect OAuth integrations from a mailbox by tricking a logged-in admin into visiting a malicious web page, resulting in loss of email synchronization and potential service disruption. The vulnerability stems from the OAuth disconnect endpoint using GET HTTP method without CSRF token validation, enabling attackers to craft simple links or embed requests in third-party sites to trigger account modifications.

Technical ContextAI

FreeScout implements mailbox OAuth management via the route /mailbox/oauth-disconnect/{id}/{in_out}/{provider}, which handles credential disconnection for integrated email providers. The vulnerability is a classic CSRF flaw (CWE-352) arising from state-changing operations exposed via GET requests without anti-forgery tokens. OAuth metadata removal is a privileged action that should require POST/PUT with token validation. The affected CPE cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:* indicates all versions prior to 1.8.215 are vulnerable.

RemediationAI

Upgrade FreeScout to version 1.8.215 or later, which implements CSRF token validation on the OAuth disconnect endpoint by converting it to a POST route with token protection. The fix is confirmed in commit eb397efae2086524ba0ee91abb916de8db7a4ac1 available at https://github.com/freescout-help-desk/freescout/commit/eb397efae2086524ba0ee91abb916de8db7a4ac1. If immediate patching is impossible, apply defense-in-depth measures: implement Content Security Policy (CSP) headers with frame-ancestors 'none' to limit iframe embedding, configure SameSite=Strict cookies for session tokens to prevent cross-site transmission (side effect: breaks some legitimate cross-origin forms), and educate admins to avoid clicking suspicious links while logged into FreeScout. These compensating controls do not eliminate the vulnerability but significantly raise attacker effort.