Ffreescout-help-desk

Products

Exploited and recent CVEs

• CVE-2026-107393 Medium 6.1 FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header 0.2%
• CVE-2026-53596 Medium 5.3 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS) 0.3%
• CVE-2026-53595 Critical 9.4 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL 1.9%
• CVE-2026-53594 Medium 4.9 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path 0.4%
• CVE-2026-53593 High 8.8 FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471 0.4%
• CVE-2026-53592 Medium 4.6 FreeScout vulnerable to prototype pollution in getQueryParam 0.1%
• CVE-2026-53591 High 8.6 FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails 0.3%
• CVE-2026-48812 High 7.5 FreeScout Allows Unauthenticated Access to Legacy Attachment Files 0.5%
• CVE-2026-45295 Medium 6.5 FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint 0.2%
• CVE-2026-45294 Medium 5.3 FreeScout: User Account Enumeration via Password Reset Response Differentiation 0.2%
• CVE-2026-47123 High 7.5 FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path 0.1%
• CVE-2026-48810 Medium 4.3 FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check 0.2%
• CVE-2026-48811 Medium 4.3 FreeScout: Thread Deletion Bypasses Mailbox Access Revocation 0.2%
• CVE-2026-41906 High 7.1 FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass 0.2%
• CVE-2026-41905 High 7.7 FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access 0.2%
• CVE-2026-41904 High 7.6 FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip_tags validator with mixed text+HTML content 0.2%
• CVE-2026-41902 Critical 9.1 FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks 0.2%
• CVE-2026-41903 Medium 5.4 FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472) 0.3%
• CVE-2026-41194 Medium 5.4 FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable 0.1%
• CVE-2026-41193 Critical 9.1 FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE 0.4%
• CVE-2026-41192 High 7.1 FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments 0.2%
• CVE-2026-41191 High 7.1 FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes 0.2%
• CVE-2026-41190 High 7.1 FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection 0.2%
• CVE-2026-41189 High 7.1 FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads 0.2%
• CVE-2026-41183 Medium 4.3 FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations 0.2%
• CVE-2026-40592 Medium 5.9 FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply 0.2%
• CVE-2026-40591 High 7.1 FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification 0.2%
• CVE-2026-40590 Medium 4.3 FreeScout's Customer AJAX Create Modifies Hidden Existing Customer 0.2%
• CVE-2026-40589 High 7.6 FreeScout has Customer Edit Cross-Mailbox Email Takeover 0.2%
• CVE-2026-40570 Medium 5.7 FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII 0.2%