---
id: CVE-2026-103985
title: >-
  FreeScout: a restricted agent can lift their own admin-imposed "see only
  assigned conversations" restriction via profile save
summary: >-
  FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the
  profile form exposes the only_assigned_tickets permission to its non-admin
  owner, and UsersController::profileSave() adds or removes
  User::PERM_ONLY_ASSIGNED_…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-269
  - CWE-284
vendor: freescout-help-desk
product: freescout
affected:
  - freescout < 1.8.231
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:46:36.800490Z'
exploitAvailable: true
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:46:55.327Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103985'
references:
  - url: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc
    label: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc
  - url: >-
      https://github.com/freescout-help-desk/freescout/commit/83030464eec3c03712ad988b81f069b372c45399
    label: >-
      https://github.com/freescout-help-desk/freescout/commit/83030464eec3c03712ad988b81f069b372c45399
  - url: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231'
    label: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231'
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-11-06T18:00:12.505Z'
epss: 0.00299
epssPercentile: 0.22793
---

## Overview

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.

## Affected

- `freescout < 1.8.231`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.