freescout-help-desk freescout

• CVE-2026-107393 Medium 6.1 FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header 0.2%
• CVE-2026-53596 Medium 5.3 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS) 0.3%
• CVE-2026-53595 Critical 9.4 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL 1.9%
• CVE-2026-53594 Medium 4.9 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path 0.4%
• CVE-2026-53593 High 8.8 FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471 0.4%
• CVE-2026-53592 Medium 4.6 FreeScout vulnerable to prototype pollution in getQueryParam 0.1%
• CVE-2026-53591 High 8.6 FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails 0.3%
• CVE-2026-48812 High 7.5 FreeScout Allows Unauthenticated Access to Legacy Attachment Files 0.5%
• CVE-2026-45295 Medium 6.5 FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint 0.2%
• CVE-2026-45294 Medium 5.3 FreeScout: User Account Enumeration via Password Reset Response Differentiation 0.2%
• CVE-2026-47123 High 7.5 FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path 0.1%
• CVE-2026-48810 Medium 4.3 FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check 0.2%
• CVE-2026-48811 Medium 4.3 FreeScout: Thread Deletion Bypasses Mailbox Access Revocation 0.2%
• CVE-2026-41906 High 7.1 FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass 0.2%
• CVE-2026-41905 High 7.7 FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access 0.2%
• CVE-2026-41904 High 7.6 FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip_tags validator with mixed text+HTML content 0.2%
• CVE-2026-41902 Critical 9.1 FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks 0.2%
• CVE-2026-41903 Medium 5.4 FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472) 0.3%
• CVE-2026-41194 Medium 5.4 FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable 0.1%
• CVE-2026-41193 Critical 9.1 FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE 0.4%
• CVE-2026-41192 High 7.1 FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments 0.2%
• CVE-2026-41191 High 7.1 FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes 0.2%
• CVE-2026-41190 High 7.1 FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection 0.2%
• CVE-2026-41189 High 7.1 FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads 0.2%
• CVE-2026-41183 Medium 4.3 FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations 0.2%
• CVE-2026-40592 Medium 5.9 FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply 0.2%
• CVE-2026-40591 High 7.1 FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification 0.2%
• CVE-2026-40590 Medium 4.3 FreeScout's Customer AJAX Create Modifies Hidden Existing Customer 0.2%
• CVE-2026-40589 High 7.6 FreeScout has Customer Edit Cross-Mailbox Email Takeover 0.2%
• CVE-2026-40570 Medium 5.7 FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII 0.2%
• CVE-2026-40569 Critical 9.0 FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration 0.3%
• CVE-2026-40568 High 8.5 FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization 0.2%
• CVE-2026-40567 Medium 5.8 FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables 0.2%
• CVE-2026-40566 Medium 4.1 FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints 0.3%
• CVE-2026-40565 Medium 6.1 FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href 0.2%
• CVE-2026-40498 High 8.9 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron 0.6%
• CVE-2026-40497 High 8.1 FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration) 0.2%
• CVE-2026-40496 High 8.8 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force 0.4%
• CVE-2026-35584 Medium 6.9 FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration 0.3%
• CVE-2026-39384 High 7.6 FreeScout Customer Merge Cross-Mailbox Authorization Bypass 0.2%
• CVE-2026-34442 Medium 5.4 FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout 0.2%
• CVE-2026-34443 Medium 6.9 FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask() 0.3%
• CVE-2026-32754 Critical 9.3 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) 0.6%
• CVE-2026-32753 High 8.5 FreeScout: Stored XSS through SVG file upload with filter bypass 0.2%
• CVE-2026-32752 None 0.0 FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages 0.3%
• CVE-2026-28289 Critical 10.0 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution 35.1%
• CVE-2026-27636 High 8.8 FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache 2.2%
• CVE-2026-27637 Critical 9.8 FreeScout's Predictable Authentication Token Enables Account Takeover 0.8%
• CVE-2025-58163 High 8.6 FreeScout's deserialization of untrusted data can lead to Remote Code Execution 0.7%
• CVE-2025-54366 High 8.6 FreeScout's deserialization of untrusted data leads to Remote Code Execution 1.1%