CVE-2026-85744
Received Received - Intake

Authorization Bypass in FreeScout Help Desk

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: GitHub, Inc.

Description
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target's existing contents. This issue is fixed in version 1.8.227.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-85744
EUVD
EUVD-2026-118376

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freescout freescout to 1.8.227 (exc)
freescout freescout to 1.8.227 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a broken access control vulnerability in FreeScout help desk software (CVE-2026-85744) affecting versions before 1.8.227. An authenticated agent can merge their own conversation into a different mailbox they lack permission to access due to a logic flaw where authorization checks are overwritten before use. This allows unauthorized cross-mailbox merges without exposing target contents.

Detection Guidance

To detect this vulnerability, check FreeScout versions before 1.8.227. Run: grep -r '1.8.227' /path/to/freescout or check the version in the admin panel. Monitor for unauthorized conversation merges or audit log entries showing unexpected thread/attachment injections.

Impact Analysis

An attacker could inject threads, attachments, and audit records into conversations they shouldn't access, permanently altering them. The source conversation is deleted during the merge, causing minor availability impact. The attacker gains no access to existing target conversation contents.

Mitigation Strategies

Upgrade FreeScout to version 1.8.227 or later immediately. Apply the patch from the official release. Review audit logs for signs of exploitation and restrict agent permissions to prevent unauthorized merges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...