---
id: CVE-2026-85744
title: 'FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass'
summary: >-
  FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the
  conversation_merge action records a failed authorization check for the target
  conversation in response['msg'] and then clears that value inside the
  source-con…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-863
vendor: freescout-help-desk
product: freescout
affected:
  - freescout < 1.8.227
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:25.166Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85744'
references:
  - url: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-v8vc-cmf9-gg2c
    label: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-v8vc-cmf9-gg2c
  - url: >-
      https://github.com/freescout-help-desk/freescout/commit/7c485c96bef7188c276906200250ce9d8a2bdfeb
    label: >-
      https://github.com/freescout-help-desk/freescout/commit/7c485c96bef7188c276906200250ce9d8a2bdfeb
  - url: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.227'
    label: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.227'
tags:
  - cve.org
ingestedAt: '2026-11-06T18:00:12.573Z'
epss: 0.00211
epssPercentile: 0.11469
---

## Overview

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target's existing contents. This issue is fixed in version 1.8.227.

## Affected

- `freescout < 1.8.227`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.