Executive Summary

CVE-2026-47123 is a vulnerability in FreeScout, a help desk software built with PHP's Laravel framework. The issue lies in the email processing pipeline, specifically in the FetchEmails command, which handles agent replies through two different code paths. One path, used for notification replies, extracts thread_id and user_id directly from the Message-ID header without verifying its authenticity using HMAC (hash-based message authentication code).

An external attacker who can spoof the From address of a helpdesk agent can craft malicious emails with a specially formatted Message-ID (e.g., notify-{thread_id}-{user_id}-...) that FreeScout mistakenly processes as legitimate agent replies. These forged replies are then automatically forwarded to customers via the legitimate SMTP server, allowing the attacker to impersonate agents and inject unauthorized messages.

The root cause is inconsistent HMAC protection between the two reply paths and the lack of email authentication checks like SPF, DKIM, or DMARC, which makes it easier for spoofed emails to be accepted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts on the integrity and trustworthiness of your help desk communications.

• An attacker can impersonate a helpdesk agent by sending forged email replies that appear legitimate.
• These forged replies are automatically forwarded to customers, potentially spreading misinformation or malicious content.
• It can lead to unauthorized disclosure or manipulation of customer communications, damaging your organization's reputation.
• Because the attack exploits missing verification and spoofed email addresses, it can be difficult to detect and prevent without proper email authentication mechanisms.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring incoming emails processed by FreeScout for suspicious Message-ID headers that follow the pattern notify-{thread_id}-{user_id}-... without proper HMAC verification.

Since the vulnerability involves spoofed emails that appear to come from helpdesk agents, checking email logs for messages with forged From addresses matching agent emails and Message-IDs lacking the expected hash can help identify exploitation attempts.

You can use commands to search mail server logs or FreeScout logs for suspicious Message-IDs or From addresses. For example:

• grep -i 'notify-' /var/log/mail.log
• grep -i 'From: [email protected]' /var/log/mail.log
• grep -E 'notify-[0-9]+-[0-9]+' /path/to/freescout/storage/logs/laravel.log

Additionally, reviewing FreeScout's FetchEmails processing logs for errors related to missing or invalid HMAC hashes in Message-IDs can help detect attempts to exploit this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade FreeScout to version 1.8.220 or later, where the vulnerability is fixed by introducing HMAC verification on the Message-ID field for notification replies.

If upgrading immediately is not possible, consider implementing email authentication mechanisms such as SPF, DKIM, and DMARC to reduce the risk of spoofed emails being accepted by your mail server.

Additionally, monitor and restrict access to the mailboxes used by FreeScout to prevent unauthorized injection of emails.

Review and harden your mail server and FreeScout configurations to reject emails with suspicious or malformed Message-IDs that do not include the expected HMAC hash.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an external attacker to spoof helpdesk agent email replies, causing unauthorized messages to be forwarded to customers via the legitimate SMTP server. This can lead to integrity violations by injecting forged content into customer communications.

Such unauthorized message injection and potential data integrity compromise could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of data integrity and confidentiality in communications.

Additionally, the lack of email authentication checks (SPF/DKIM/DMARC) in FreeScout exacerbates the risk of spoofed emails being processed, increasing the likelihood of unauthorized data disclosure or manipulation.

Useful 0 Not Useful 0