FreeScout, a self-hosted help desk and shared mailbox application, had an authorization flaw in versions before 1.8.215. Specifically, the MailboxesController::updateSave() function persisted the 'chat_start_new' setting without proper filtering against allowed fields. Users with only the mailbox 'sig' permission, who should only be able to edit the signature field, could exploit this to change the mailbox-wide chat setting by sending crafted POST requests. This constitutes a CWE-863 (Incorrect Authorization) vulnerability. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity, with network attack vector, low attack complexity, and requiring low privileges but no user interaction.

An attacker with limited mailbox permissions can modify mailbox-wide chat settings that they should not have access to change. This could lead to unauthorized changes in mailbox behavior or configuration, potentially impacting the integrity of mailbox operations. There is no indication of confidentiality or availability impact beyond the integrity impact described.

Upgrade FreeScout to version 1.8.215 or later, where this vulnerability is fixed. Since the vendor has released a version that addresses this issue, applying the official update is the recommended remediation. Patch status is confirmed by the version information in the advisory.