FreeScout, a PHP Laravel-based help desk application, had an authorization bypass vulnerability (CWE-639) where the backend API action conversation_change_customer accepted user-supplied customer_email values without enforcing mailbox scope restrictions. Although the Change Customer modal frontend correctly filtered customers by mailbox, the backend did not, enabling low-privileged agents to associate conversations with customers outside their permitted mailbox scope. This flaw was fixed in FreeScout version 1.8.214.

An attacker with low privileges can manipulate conversation ownership by associating conversations with customers from mailboxes they should not access. This leads to unauthorized modification of conversation data (integrity impact) and limited confidentiality impact due to exposure of out-of-scope customer associations. The CVSS v3.1 score is 7.1 (high severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality loss with high integrity impact.

Upgrade FreeScout to version 1.8.214 or later, where this authorization bypass vulnerability has been patched. No other mitigation steps are indicated by the vendor advisory. Patch status is not explicitly stated but the vendor has released a fixed version addressing this issue.