# cve.now: Freescout-help-desk

The newest entries naming Freescout-help-desk as an affected vendor (up to 200), of 85 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-85742](https://cve.now/CVE-2026-85742.md): FreeScout: Conditional stored admin XSS via failed-job details (CVSS 7.5)
- [CVE-2026-103985](https://cve.now/CVE-2026-103985.md): FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save (CVSS 7.1)
- [CVE-2026-103984](https://cve.now/CVE-2026-103984.md): FreeScout: Incomplete fix for CVE-2026-40570: load\_customer\_info exposes cross-visibility customer PII (CVSS 6.5)
- [CVE-2026-85743](https://cve.now/CVE-2026-85743.md): FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks (CVSS 8.2)
- [CVE-2026-85744](https://cve.now/CVE-2026-85744.md): FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass (CVSS 5.4)
- [CVE-2026-62850](https://cve.now/CVE-2026-62850.md): FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled… (CVSS 5.3)
- [CVE-2026-62852](https://cve.now/CVE-2026-62852.md): FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through… (CVSS 6.5)
- [CVE-2026-62855](https://cve.now/CVE-2026-62855.md): FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files (CVSS 4.4)
- [CVE-2026-62851](https://cve.now/CVE-2026-62851.md): FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (\`#\`) shortcut (missing mailbox… (CVSS 4.3)
- [CVE-2026-62856](https://cve.now/CVE-2026-62856.md): FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query (CVSS 7.7)
- [CVE-2026-62854](https://cve.now/CVE-2026-62854.md): FreeScout: Stored XSS in mailbox signature via same-origin JS upload (CVSS 7.6)
- [CVE-2026-107393](https://cve.now/CVE-2026-107393.md): FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header (CVSS 6.1)
- [CVE-2026-53596](https://cve.now/CVE-2026-53596.md): FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS) (CVSS 5.3)
- [CVE-2026-53595](https://cve.now/CVE-2026-53595.md): FreeScout vulnerable to anonymous account takeover via /user-setup empty invite\_hash on MySQL (CVSS 9.4)
- [CVE-2026-53594](https://cve.now/CVE-2026-53594.md): FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path (CVSS 4.9)
- [CVE-2026-53593](https://cve.now/CVE-2026-53593.md): FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471 (CVSS 8.8)
- [CVE-2026-53592](https://cve.now/CVE-2026-53592.md): FreeScout vulnerable to prototype pollution in getQueryParam (CVSS 4.6)
- [CVE-2026-53591](https://cve.now/CVE-2026-53591.md): FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails (CVSS 8.6)
- [CVE-2026-48812](https://cve.now/CVE-2026-48812.md): FreeScout Allows Unauthenticated Access to Legacy Attachment Files (CVSS 7.5)
- [CVE-2026-45295](https://cve.now/CVE-2026-45295.md): FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint (CVSS 6.5)
- [CVE-2026-45294](https://cve.now/CVE-2026-45294.md): FreeScout: User Account Enumeration via Password Reset Response Differentiation (CVSS 5.3)
- [CVE-2026-47123](https://cve.now/CVE-2026-47123.md): FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path (CVSS 7.5)
- [CVE-2026-48810](https://cve.now/CVE-2026-48810.md): FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check (CVSS 4.3)
- [CVE-2026-48811](https://cve.now/CVE-2026-48811.md): FreeScout: Thread Deletion Bypasses Mailbox Access Revocation (CVSS 4.3)
- [CVE-2026-41906](https://cve.now/CVE-2026-41906.md): FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass (CVSS 7.1)
- [CVE-2026-41905](https://cve.now/CVE-2026-41905.md): FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access (CVSS 7.7)
- [CVE-2026-41904](https://cve.now/CVE-2026-41904.md): FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip\_tags validator with mixed text+HTML content (CVSS 7.6)
- [CVE-2026-41902](https://cve.now/CVE-2026-41902.md): FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks (CVSS 9.1)
- [CVE-2026-41903](https://cve.now/CVE-2026-41903.md): FreeScout IDOR Vulnerability: PERM\_EDIT\_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472) (CVSS 5.4)
- [CVE-2026-41194](https://cve.now/CVE-2026-41194.md): FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable (CVSS 5.4)
- [CVE-2026-41193](https://cve.now/CVE-2026-41193.md): FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE (CVSS 9.1)
- [CVE-2026-41192](https://cve.now/CVE-2026-41192.md): FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments (CVSS 7.1)
- [CVE-2026-41191](https://cve.now/CVE-2026-41191.md): FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes (CVSS 7.1)
- [CVE-2026-41190](https://cve.now/CVE-2026-41190.md): FreeScout has assigned-only visibility bypass via save\_draft that allows hidden conversation draft injection (CVSS 7.1)
- [CVE-2026-41189](https://cve.now/CVE-2026-41189.md): FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads (CVSS 7.1)
- [CVE-2026-41183](https://cve.now/CVE-2026-41183.md): FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations (CVSS 4.3)
- [CVE-2026-40592](https://cve.now/CVE-2026-40592.md): FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply (CVSS 5.9)
- [CVE-2026-40591](https://cve.now/CVE-2026-40591.md): FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification (CVSS 7.1)
- [CVE-2026-40590](https://cve.now/CVE-2026-40590.md): FreeScout's Customer AJAX Create Modifies Hidden Existing Customer (CVSS 4.3)
- [CVE-2026-40589](https://cve.now/CVE-2026-40589.md): FreeScout has Customer Edit Cross-Mailbox Email Takeover (CVSS 7.6)
- [CVE-2026-40570](https://cve.now/CVE-2026-40570.md): FreeScout's Missing Authorization in load\_customer\_info Allows Any Authenticated User to Access Full Customer PII (CVSS 5.7)
- [CVE-2026-40569](https://cve.now/CVE-2026-40569.md): FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration (CVSS 9.0)
- [CVE-2026-40568](https://cve.now/CVE-2026-40568.md): FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization (CVSS 8.5)
- [CVE-2026-40567](https://cve.now/CVE-2026-40567.md): FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables (CVSS 5.8)
- [CVE-2026-40566](https://cve.now/CVE-2026-40566.md): FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints (CVSS 4.1)
- [CVE-2026-40565](https://cve.now/CVE-2026-40565.md): FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href (CVSS 6.1)
- [CVE-2026-40498](https://cve.now/CVE-2026-40498.md): FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron (CVSS 8.9)
- [CVE-2026-40497](https://cve.now/CVE-2026-40497.md): FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration) (CVSS 8.1)
- [CVE-2026-40496](https://cve.now/CVE-2026-40496.md): FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force (CVSS 8.8)
- [CVE-2026-35584](https://cve.now/CVE-2026-35584.md): FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration (CVSS 6.9)
- [CVE-2026-39384](https://cve.now/CVE-2026-39384.md): FreeScout Customer Merge Cross-Mailbox Authorization Bypass (CVSS 7.6)
- [CVE-2026-34442](https://cve.now/CVE-2026-34442.md): FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout (CVSS 5.4)
- [CVE-2026-34443](https://cve.now/CVE-2026-34443.md): FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask() (CVSS 6.9)
- [CVE-2026-32754](https://cve.now/CVE-2026-32754.md): FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread-\>body !!}) (CVSS 9.3)
- [CVE-2026-32753](https://cve.now/CVE-2026-32753.md): FreeScout: Stored XSS through SVG file upload with filter bypass (CVSS 8.5)
- [CVE-2026-32752](https://cve.now/CVE-2026-32752.md): FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages (CVSS 0.0)
- [CVE-2026-28289](https://cve.now/CVE-2026-28289.md): FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution (CVSS 10.0)
- [CVE-2026-27636](https://cve.now/CVE-2026-27636.md): FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache (CVSS 8.8)
- [CVE-2026-27637](https://cve.now/CVE-2026-27637.md): FreeScout's Predictable Authentication Token Enables Account Takeover (CVSS 9.8)
- [CVE-2025-58163](https://cve.now/CVE-2025-58163.md): FreeScout's deserialization of untrusted data can lead to Remote Code Execution (CVSS 8.6)
- [CVE-2025-54366](https://cve.now/CVE-2025-54366.md): FreeScout's deserialization of untrusted data leads to Remote Code Execution (CVSS 8.6)
- [CVE-2025-48488](https://cve.now/CVE-2025-48488.md): FreeScout Vulnerable to Stored XSS (CVSS 4.6)
- [CVE-2025-48880](https://cve.now/CVE-2025-48880.md): FreeScout has Race Condition When Deleting Users (CVSS 5.1)
- [CVE-2025-48875](https://cve.now/CVE-2025-48875.md): FreeScout Vulnerable to Stored XSS (CVSS 4.6)
- [CVE-2025-48489](https://cve.now/CVE-2025-48489.md): FreeScout Vulnerable to Stored XSS (CVSS 4.6)
- [CVE-2025-48487](https://cve.now/CVE-2025-48487.md): FreeScout Vulnerable to Stored XSS (CVSS 6.0)
- [CVE-2025-48486](https://cve.now/CVE-2025-48486.md): FreeScout Vulnerable to Stored XSS (CVSS 6.1)
- [CVE-2025-48485](https://cve.now/CVE-2025-48485.md): FreeScout Vulnerable to Stored XSS (CVSS 6.1)
- [CVE-2025-48484](https://cve.now/CVE-2025-48484.md): FreeScout Vulnerable to Stored XSS (CVSS 4.6)
- [CVE-2025-48483](https://cve.now/CVE-2025-48483.md): FreeScout Stored XSS leads to CSRF (CVSS 6.3)
- [CVE-2025-48482](https://cve.now/CVE-2025-48482.md): FreeScout Has Business Logic Errors (CVSS 5.3)
- [CVE-2025-48481](https://cve.now/CVE-2025-48481.md): FreeScout Has Business Logic Errors (CVSS 6.1)
- [CVE-2025-48480](https://cve.now/CVE-2025-48480.md): FreeScout Has Business Logic Errors (CVSS 7.0)
- [CVE-2025-48479](https://cve.now/CVE-2025-48479.md): FreeScout Has Business Logic Errors (CVSS 8.5)
- [CVE-2025-48478](https://cve.now/CVE-2025-48478.md): FreeScout Has Business Logic Errors (CVSS 7.0)
- [CVE-2025-48477](https://cve.now/CVE-2025-48477.md): FreeScout Has Business Logic Errors (CVSS 7.1)
- [CVE-2025-48476](https://cve.now/CVE-2025-48476.md): FreeScout Has Business Logic Errors (CVSS 7.1)
- [CVE-2025-48475](https://cve.now/CVE-2025-48475.md): FreeScout Vulnerable to Insufficient Authorization (CVSS 5.3)
- [CVE-2025-48474](https://cve.now/CVE-2025-48474.md): FreeScout Vulnerable to Insufficient Authorization (CVSS 5.3)
- [CVE-2025-48473](https://cve.now/CVE-2025-48473.md): FreeScout Vulnerable to Insufficient Authorization (CVSS 5.3)
- [CVE-2025-48472](https://cve.now/CVE-2025-48472.md): FreeScout Vulnerable to Insufficient Authorization (CVSS 6.9)
- [CVE-2025-48471](https://cve.now/CVE-2025-48471.md): FreeScout Vulnerable to Arbitrary File Upload (CVSS 7.0)
- [CVE-2025-48390](https://cve.now/CVE-2025-48390.md): FreeScout Vulnerable to Remote Code Execution (RCE) (CVSS 8.6)
- [CVE-2025-48389](https://cve.now/CVE-2025-48389.md): FreeScout Vulnerable to Deserialization of Untrusted Data (CVSS 8.6)
- [CVE-2025-48388](https://cve.now/CVE-2025-48388.md): FreeScout Has Insufficient Protection Against CRLF-injection (CVSS 7.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/freescout-help-desk
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.