What is the CVSS score of EUVD-2026-28406?

EUVD-2026-28406 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-28406?

Yes, a patch is available for EUVD-2026-28406. Update the affected software to the latest version immediately.

FreeScout EUVD-2026-28406

| CVE-2026-41903 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-07 GitHub_M

Authentication Bypass Freescout

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 07, 2026 - 20:02 EUVD

Source Code Evidence Fetched

May 07, 2026 - 19:45 vuln.today

Analysis Generated

May 07, 2026 - 19:45 vuln.today

CVE Published

May 07, 2026 - 18:02 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user holding the PERM_EDIT_USERS permission (intended for general user-profile editing) can read and modify the notification subscriptions of any other user, including admins, by sending a single POST request. This is a sibling of CVE-2025-48472's notification authorization bypass - the prior fix did not cover this code path. A non-admin attacker can silently disable an admin's email/browser/mobile notifications, suppressing security alerts and conversation-assignment notices. This issue has been patched in version 1.8.217.

AnalysisAI

FreeScout versions prior to 1.8.217 allow authenticated users with PERM_EDIT_USERS permission to read and modify notification subscriptions of any other user, including administrators, via a single POST request. This authorization bypass enables attackers to silently disable admin notifications, suppressing security alerts and conversation assignments without detection. The vulnerability is a sibling of CVE-2025-48472, indicating incomplete patching of a related code path.

Technical ContextAI

FreeScout is a PHP-based Laravel help desk application. The vulnerability stems from insufficient permission validation in the notification settings endpoint (CWE-863: Incorrect Authorization). The PERM_EDIT_USERS permission was designed for general user-profile editing but lacks granular checks to prevent cross-user notification subscription manipulation. Laravel's permission model allows role-based access control, but this implementation failed to isolate notification settings from the broader user-editing scope. The vulnerability affects the notification subscription feature, which governs email, browser, and mobile alert delivery channels for security events and task assignments.

RemediationAI

Upgrade FreeScout to version 1.8.217 or later immediately. The vendor has confirmed the fix in release 1.8.217, which implements proper permission checks for the notification settings endpoint (referenced in security advisory GHSA-f489-qxv6-gvgg). As a temporary workaround if immediate upgrade is impossible, restrict the PERM_EDIT_USERS permission to trusted administrators only and regularly audit user-permission assignments to detect unauthorized elevation. Additionally, enable audit logging for permission and notification configuration changes to detect exploitation attempts. Monitor admin notification delivery rates and investigate gaps that may indicate silent disabling. Note that FreeScout should implement endpoint-level permission checks in addition to role-based access to prevent similar vulnerabilities in related features, as evidenced by the CVE-2025-48472 sibling issue.