FreeScout versions prior to 1.8.235 contain a cross-site scripting (XSS) vulnerability when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts the CF-Connecting-IP header during failed login attempts without validation and stores this value in the activity log. The LogsMonitor component inserts this unescaped value into administrator alert emails, allowing injected HTML to execute when the email is viewed. This vulnerability is fixed in version 1.8.235.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.
FreeScout versions prior to 1.8.224 contain a critical vulnerability in the public user setup endpoint that allows an unauthenticated attacker to overwrite the email and password of the lowest-id activated user account and log in as that user. This occurs due to improper handling of case sensitivity and trailing spaces in the invite_hash field on MySQL/MariaDB, combined with a flawed decryption check that allows bypassing the expiry guard. The vulnerability is fixed in version 1.8.224.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the bundled `rap2hpoutre/laravel-log-viewer` override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior to version 1.8.224, the path resolution logic accepts any existing absolute path before applying the intended `storage/logs` restriction. As a result, an attacker who can access the App Logs route and forge a valid Laravel-encrypted `dl` parameter can download arbitrary server-local files readable by the PHP process, not just log files. Version 1.8.224 contains a fix.
FreeScout versions prior to 1.8.224 have an incomplete denylist for dangerous file uploads, missing the .pht extension. Authenticated users can upload .pht files, which are executed by default Apache PHP handlers, allowing arbitrary command execution as the web server user. This vulnerability is a direct bypass of a previous fix and is addressed in version 1.8.224.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/main.js` and was addressed in version 1.8.139 by blocking URL query keys matching the pattern `__proto__`. However, this mitigation is incomplete: it only filters top-level `__proto__` keys and fails to sanitize nested forms such as `b[__proto__][polluted]=PWNED`. As a result, an attacker-controlled URL query string can still write into `Object.prototype` on any page that loads `main.js`. Version 1.8.223 contains a updated fix.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted `In-Reply-To` header. No credentials, tokens, or prior access are required. The injected message is rendered in the agent UI as a legitimate customer reply, the conversation is automatically reopened, and the `last_reply_from` field is set to the attacker's identity. Version 1.8.223 contains a fix.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. Version 1.8.221 contains a fix.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conversation_id}/{thread_id}` allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (`opened_at` timestamp) without any authentication. Version 1.8.219 patches the issue.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two code paths for identifying agent (user) replies based on In-Reply-To / References headers. The notification reply path (notify-{thread_id}-{user_id}-...) extracts thread_id and user_id directly from the Message-ID without HMAC verification. An external attacker who can spoof the From address of a helpdesk agent can inject messages that FreeScout processes as legitimate agent replies — which are then automatically forwarded to customers via the legitimate SMTP server. This vulnerability is fixed in 1.8.220.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, while investigating the ThreadPolicy::delete issue reported previously, the same missing mailbox membership check was found in the sibling ThreadPolicy::edit method. A user with the PERM_EDIT_CONVERSATIONS permission who created a message or internal note in Mailbox A can rewrite that thread's body after an administrator removes them from Mailbox A, because the policy checks only authorship and a global permission flag — not current mailbox membership. This vulnerability is fixed in 1.8.221.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note (private thread) from any conversation, even after that user's access to the mailbox containing the conversation has been revoked. The ThreadPolicy::delete authorization policy does not verify mailbox membership, so a former team member retains destructive write access to notes they created. This vulnerability is fixed in 1.8.221.
CVE-2026-41906 is an authorization bypass vulnerability in FreeScout versions prior to 1.8.214. It allows a low-privileged agent to associate a visible conversation with a hidden customer from another mailbox by exploiting the backend conversation_change_customer action, which improperly accepts any supplied customer_email. The issue arises because the frontend correctly filters customers by mailbox scope, but the backend does not enforce this restriction. This vulnerability has been patched in version 1.8.214.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::sanitizeRemoteUrl() in app/Misc/Helper.php follows HTTP redirects via curlGetLastRedirectedUrl() but then re-validates the original URL instead of the final redirect destination. An attacker who can supply any URL that passes the initial host check can redirect FreeScout to internal HTTP services (cloud metadata, internal APIs, RFC1918 ranges) that would normally be blocked. This issue has been patched in version 1.8.217.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with updateAutoReply permission can store an XSS payload in the mailbox auto-reply message. The payload is rendered unescaped in the auto-reply email sent to every customer who contacts the mailbox. Email clients do not enforce CSP, so the payload executes in the customer's webmail / mail-client context. This issue has been patched in version 1.8.217.
FreeScout versions prior to 1.8.217 contain a critical vulnerability in the /user-setup/{hash} endpoint where the invite_hash used for setting a new user's password does not expire. This allows an attacker who obtains a leaked invite hash to perform a permanent unauthenticated account takeover, potentially gaining admin access if the invite was for an admin user. The issue has been fixed in version 1.8.217.
CVE-2026-41903 is an authorization vulnerability in FreeScout versions prior to 1.8.217. Users with the PERM_EDIT_USERS permission, intended only for general user-profile editing, can exploit this flaw to read and modify notification subscriptions of any other user, including administrators, by sending a crafted POST request. This allows a non-admin attacker to silently disable admin notifications such as email, browser, and mobile alerts, potentially suppressing important security and operational messages. The issue is a variant of a previously addressed notification authorization bypass but affects a different code path. A patch fixing this vulnerability is available in FreeScout version 1.8.217. The CVSS score is 5.
FreeScout versions prior to 1.8.215 contain a Cross-Site Request Forgery (CSRF) vulnerability in the mailbox OAuth disconnect functionality. The affected endpoint uses a GET request without requiring a CSRF token, allowing an attacker to trigger the OAuth disconnect action cross-site against a logged-in mailbox admin. This vulnerability was fixed in version 1.8.215.
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, FreeScout's module installation feature extracts ZIP archives without validating file paths, allowing an authenticated admin to write files arbitrarily on the server filesystem via a specially crafted ZIP. Version 1.8.215 fixes the vulnerability.