CVE-2026-53591
Received Received - Intake

Email Header Injection in FreeScout Help Desk

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted `In-Reply-To` header. No credentials, tokens, or prior access are required. The injected message is rendered in the agent UI as a legitimate customer reply, the conversation is automatically reopened, and the `last_reply_from` field is set to the attacker's identity. Version 1.8.223 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-53591
EUVD
EUVD-2026-46081

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freescout freescout to 1.8.223 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated attacker to inject fake messages into any existing support conversation in FreeScout by sending an email with a manipulated In-Reply-To header. The system fails to properly verify the message's origin, treating the injected content as a legitimate customer reply. This bypasses authentication checks due to a flaw in HMAC verification logic.

Detection Guidance

Check FreeScout email logs for suspicious In-Reply-To headers with non-standard HMAC lengths or thread IDs outside expected ranges. Monitor for unexpected conversation reopenings or last_reply_from field changes.

Impact Analysis

Attackers can manipulate conversation history, influence agent decisions, and disrupt support workflows. Closed tickets may reopen automatically, and the attacker's identity is falsely recorded as the last responder. This could lead to misinformation, incorrect issue resolution, and confusion in support operations.

Compliance Impact

This vulnerability compromises data integrity by allowing unauthorized modifications to support conversations. For GDPR, this could violate principles of accuracy and integrity of personal data. For HIPAA, it may breach integrity requirements for protected health information records. Compliance could be impacted if conversation logs are used for auditing or legal purposes.

Mitigation Strategies

Upgrade FreeScout to version 1.8.223 or later immediately. If immediate upgrade is not possible, review and patch the FetchEmails.php file to enforce HMAC verification for all In-Reply-To headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart