FreeScout EUVD-2026-33438

Exploitation requires all of the following: (1) an authenticated FreeScout user account holding the global PERM_EDIT_CONVERSATIONS permission; (2) that user must have previously authored at least one thread or internal note in the targeted mailbox; (3) an administrator must have subsequently removed that user from the mailbox - it is specifically this post-removal state that exposes the gap between the revoked mailbox membership and the still-passing policy check. The attacker can only tamper with threads they originally authored; they cannot edit threads created by other users. Exploitation is limited to integrity impact on thread body content. The CVSS PR:L vector confirms at least low-privilege authenticated access is required, ruling out unauthenticated exploitation. The attack surface exists only in deployments where user-to-mailbox membership is managed dynamically (e.g., team changes, offboarding), and where users are removed from mailboxes without also revoking their system-wide PERM_EDIT_CONVERSATIONS flag.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects a network-reachable, low-complexity flaw requiring only low-privilege (authenticated) access with no user interaction. The impact is confined to integrity - specifically the ability to rewrite thread body content - with no confidentiality or availability components. No EPSS score was provided in source data. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified at time of analysis. Real-world risk is narrower than the CVSS score might suggest alone: exploitation is gated on a specific post-offboarding state where an administrator has removed a user from a mailbox but that user retains the global PERM_EDIT_CONVERSATIONS permission. The attack window exists only within that gap. This is a genuine integrity concern in multi-tenant or multi-team FreeScout deployments where access revocation is relied upon as a security boundary, but it is not a broadly exploitable vulnerability against default or single-team configurations.

An agent user who was previously a member of Mailbox A and authored several support threads there is removed from Mailbox A by an administrator during an access review or offboarding process. Retaining their FreeScout account and the system-wide PERM_EDIT_CONVERSATIONS permission, the user directly submits an HTTP edit request referencing a thread ID from Mailbox A - a thread they originally authored. The ThreadPolicy::edit check passes (authorship confirmed, permission flag present), and the thread body is overwritten, allowing tampering with documented support history or injection of misleading content visible to current Mailbox A agents and customers. No public proof-of-concept code has been identified, but the attack is mechanically straightforward for any user aware of the API endpoint.