FreeScout before version 1.8.214 contains a missing authorization vulnerability (CWE-862) in the undo-send route `GET /conversation/undo-reply/{thread_id}`. The route checks only if the current user can view the parent conversation but fails to verify if the user created the reply they attempt to undo. Consequently, in a shared mailbox environment, one agent can recall another agent's reply during the 15-second undo window, potentially disrupting message integrity. The vulnerability has a CVSS 3.1 base score of 5.9 (medium severity) and does not affect confidentiality but impacts integrity and availability to a limited extent. The issue is resolved in FreeScout version 1.8.214.

The vulnerability allows an authenticated user with permission to view a conversation to undo replies sent by other users within a short time frame, potentially causing unauthorized alteration of message history in a shared mailbox. This impacts the integrity of communications but does not expose confidential data or allow privilege escalation. There are no known exploits in the wild at this time.

Upgrade FreeScout to version 1.8.214 or later, where this authorization flaw is fixed. Since this is a self-hosted product, administrators should apply the update promptly to prevent unauthorized undo actions among agents. No other mitigations are indicated by the vendor advisory.