CVE-2026-41189
Authorization Bypass in FreeScout Customer-Thread Editing Pre
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freescout | freescout | 1.8.215 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in FreeScout prior to version 1.8.215 allows unauthorized users to edit customer-authored threads in conversations they are not assigned to and cannot view. This unauthorized modification of customer data compromises data integrity.
Such unauthorized access and modification of customer information can lead to non-compliance with common data protection standards and regulations like GDPR and HIPAA, which require strict controls on data access and integrity to protect personal and sensitive information.
By allowing users to bypass assigned-only visibility controls and edit hidden customer threads, the vulnerability undermines confidentiality and integrity principles essential for regulatory compliance.
Can you explain this vulnerability to me?
CVE-2026-41189 is an authorization vulnerability in FreeScout versions prior to 1.8.215 affecting the customer-thread editing functionality.
The vulnerability occurs because the method responsible for authorizing edits to customer threads (`ThreadPolicy::edit()`) only checks if a user has access to the mailbox but does not enforce the restriction that users can only edit conversations they are assigned to.
As a result, a user who cannot view a conversation can still load and edit customer-authored threads inside that conversation, bypassing assigned-only visibility controls.
This flaw allows unauthorized users to modify customer messages in conversations they are not assigned to, compromising data integrity.
The issue was fixed in FreeScout version 1.8.215 by adding stricter permission checks that ensure only assigned users can edit customer threads.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to edit customer-authored threads in conversations they are not permitted to access.
Even if a user is blocked from viewing a conversation, they can still load the thread editor and make changes to the customer messages within that conversation.
This unauthorized modification compromises the integrity of customer data, potentially leading to misinformation, loss of trust, or operational issues in your help desk system.
The vulnerability does not affect system availability but poses a significant risk to data integrity and confidentiality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by verifying if unauthorized users are able to load and edit customer-authored threads in conversations they are not assigned to or cannot view.
Verification steps include checking if a non-assigned user can access a hidden conversation (which should return HTTP 403) but still load the thread editor via AJAX and save edits.
Database queries can be used to confirm unauthorized edits by checking if the edited_by_user_id field reflects a user who should not have access.
Example commands demonstrated in the advisory include using Docker and PostgreSQL commands to identify hidden conversations and threads, and testing access via HTTP requests.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade FreeScout to version 1.8.215 or later, where this vulnerability has been fixed.
The fix enforces stricter permission checks in the ThreadPolicy::edit() method, ensuring that users restricted to assigned-only conversations cannot edit threads in conversations they are not assigned to.
Until the upgrade is applied, restrict user privileges to prevent unauthorized editing and monitor for suspicious activity involving thread edits by non-assigned users.