FreeScout EUVD-2026-33440

Exploitation requires the attacker to (1) send mail whose From address appears to be a legitimate FreeScout agent's address that the target mailbox will accept (so environments enforcing strict SPF/DKIM/DMARC alignment on inbound mail significantly raise the bar), and (2) supply an In-Reply-To or References header matching the notify-{thread_id}-{user_id}-{timestamp} pattern with valid numeric IDs for an existing thread and assigned agent. No FreeScout authentication is required (CVSS PR:N) and no victim interaction is needed (UI:N), but the High Attack Complexity reflects the need to guess or obtain valid thread/user IDs - these are sequential integers, so an attacker with any prior email exchange with the helpdesk can typically learn them. Only FreeScout instances running a version earlier than 1.8.220 with the email-fetching pipeline (FetchEmails) enabled - the default deployment mode - are exposed.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N scores 7.5 (High), reflecting network-reachable, unauthenticated exploitation with high integrity impact and a scope change (the helpdesk's SMTP identity is leveraged to communicate with third-party customers). Attack Complexity High reflects the prerequisites: the attacker must be able to spoof the agent's From address and either know or guess a valid thread_id and user_id pair. EPSS data was not provided and the CVE is not listed in CISA KEV, and no public exploit was identified at time of analysis, so this should be treated as a credible-but-not-yet-mass-exploited weakness. The most important real-world risk signal is the Scope:Changed value - successful exploitation impersonates the helpdesk to its customers, enabling phishing, fraud, and social-engineering pivots that extend well beyond the FreeScout instance itself.

An attacker identifies a target organization using FreeScout, guesses or harvests a valid thread_id and the corresponding agent's user_id (for example, from prior email correspondence with the helpdesk), and sends an email from a spoofed agent address with an In-Reply-To header of the form notify-{thread_id}-{user_id}-{timestamp}@helpdesk.example. FreeScout treats the inbound message as a legitimate agent reply and automatically relays the attacker's content to the original customer through the organization's own SMTP server, enabling convincing phishing, payment-redirection fraud, or malware delivery under the helpdesk's trusted identity.