CVE-2026-41903: CWE-863: Incorrect Authorization in freescout-help-desk freescout
CVE-2026-41903 is an authorization vulnerability in FreeScout versions prior to 1.8.217. Users with the PERM_EDIT_USERS permission, intended only for general user-profile editing, can exploit this flaw to read and modify notification subscriptions of any other user, including administrators, by sending a crafted POST request. This allows a non-admin attacker to silently disable admin notifications such as email, browser, and mobile alerts, potentially suppressing important security and operational messages. The issue is a variant of a previously addressed notification authorization bypass but affects a different code path. A patch fixing this vulnerability is available in FreeScout version 1.8.217. The CVSS score is 5.
AI Analysis
Technical Summary
FreeScout versions before 1.8.217 contain an incorrect authorization vulnerability (CWE-863) where users with the PERM_EDIT_USERS permission can manipulate notification subscriptions of other users, including admins. This is achieved by sending a single POST request that bypasses intended access controls. The vulnerability enables attackers to disable critical notifications silently, impacting alerting mechanisms. This issue is related to but distinct from CVE-2025-48472, as the previous fix did not cover this specific code path. The vulnerability has been patched in version 1.8.217.
Potential Impact
An attacker with limited privileges (PERM_EDIT_USERS) can alter notification settings of any user, including administrators, without their knowledge. This can suppress security alerts and conversation-assignment notifications, potentially delaying response to security incidents or operational issues. There is no direct confidentiality impact, but integrity and availability of notification mechanisms are affected.
Mitigation Recommendations
Upgrade FreeScout to version 1.8.217 or later, where this vulnerability has been patched. No other official remediation or temporary fixes are documented. Users should apply the update promptly to restore proper authorization controls on notification subscription management.
CVE-2026-41903: CWE-863: Incorrect Authorization in freescout-help-desk freescout
Description
CVE-2026-41903 is an authorization vulnerability in FreeScout versions prior to 1.8.217. Users with the PERM_EDIT_USERS permission, intended only for general user-profile editing, can exploit this flaw to read and modify notification subscriptions of any other user, including administrators, by sending a crafted POST request. This allows a non-admin attacker to silently disable admin notifications such as email, browser, and mobile alerts, potentially suppressing important security and operational messages. The issue is a variant of a previously addressed notification authorization bypass but affects a different code path. A patch fixing this vulnerability is available in FreeScout version 1.8.217. The CVSS score is 5.
CVSS v3.1
Score 5.4medium
Affected software
pkg:github/freescout-help-desk/freescoutRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FreeScout versions before 1.8.217 contain an incorrect authorization vulnerability (CWE-863) where users with the PERM_EDIT_USERS permission can manipulate notification subscriptions of other users, including admins. This is achieved by sending a single POST request that bypasses intended access controls. The vulnerability enables attackers to disable critical notifications silently, impacting alerting mechanisms. This issue is related to but distinct from CVE-2025-48472, as the previous fix did not cover this specific code path. The vulnerability has been patched in version 1.8.217.
Potential Impact
An attacker with limited privileges (PERM_EDIT_USERS) can alter notification settings of any user, including administrators, without their knowledge. This can suppress security alerts and conversation-assignment notifications, potentially delaying response to security incidents or operational issues. There is no direct confidentiality impact, but integrity and availability of notification mechanisms are affected.
Mitigation Recommendations
Upgrade FreeScout to version 1.8.217 or later, where this vulnerability has been patched. No other official remediation or temporary fixes are documented. Users should apply the update promptly to restore proper authorization controls on notification subscription management.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-22T15:11:54.672Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fcdf2dcbff5d86101f12dc
Added to database: 05/07/2026, 18:51:25 UTC
Last enriched: 05/15/2026, 10:50:34 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 107
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.