CVE-2026-103985
Received Received - Intake

Stored XSS in FreeScout Help Desk

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: GitHub, Inc.

Description
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-103985
EUVD
EUVD-2026-118381

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freescout freescout to 1.8.230 (exc)
freescout freescout to 1.8.231 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeScout is a self-hosted help desk system. This vulnerability allows a restricted agent to bypass an administrator-imposed restriction that limits their access to only assigned conversations. The agent can edit their own profile to remove the 'see only assigned conversations' setting without needing admin rights, gaining access to all conversations in mailboxes they belong to.

Detection Guidance

Check FreeScout version with: grep -r "version" /path/to/freescout/config/app.php. If version is below 1.8.231, the system is vulnerable. Review user profile settings for the 'Assigned Conversations' option in the admin panel. Non-admin users should not have access to this setting.

Impact Analysis

An attacker with restricted agent access could read, modify, reply to, reassign, or delete conversations assigned to other agents. This could lead to unauthorized access to sensitive customer data, potential data breaches, and misuse of support systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected FreeScout versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade FreeScout to version 1.8.231 or later immediately. Verify that only administrators can access and modify the 'Assigned Conversations' permission in user profiles. Audit user permissions to ensure no unauthorized access changes were made.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103985. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...