CVE-2026-103985High· 7.1▾ MidnightPoC availableFreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 39.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.
freescout < 1.8.231Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103984Medium· 6.5FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII
CVE-2026-62855Medium· 4.4FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files
CVE-2026-107393Medium· 6.1FreeScout is a self-hosted help desk and shared mailbox
CVE-2026-62854High· 7.6FreeScout: Stored XSS in mailbox signature via same-origin JS upload
CVE-2026-62851Medium· 4.3FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortcut (missing mailbox authorization)
CVE-2026-62856High· 7.7FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query