Freescout-help-desk vulnerabilities
85 CVEs and advisories name Freescout-help-desk as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-41193FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE
- CVE-2026-41192FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments
- CVE-2026-41191FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes
- CVE-2026-41190FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection
- CVE-2026-41189FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads
- CVE-2026-41183FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations
- CVE-2026-40592FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply
- CVE-2026-40591FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification
- CVE-2026-40590FreeScout's Customer AJAX Create Modifies Hidden Existing Customer
- CVE-2026-40589FreeScout has Customer Edit Cross-Mailbox Email Takeover
- CVE-2026-40570FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII
- CVE-2026-40569FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration
- CVE-2026-40568FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization
- CVE-2026-40567FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables
- CVE-2026-40566FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints
- CVE-2026-40565FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href
- CVE-2026-40498FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
- CVE-2026-40497FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)
- CVE-2026-40496FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force
- CVE-2026-35584FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration
- CVE-2026-39384FreeScout Customer Merge Cross-Mailbox Authorization Bypass
- CVE-2026-34442FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout
- CVE-2026-34443FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()
- CVE-2026-32754FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
- CVE-2026-32753FreeScout: Stored XSS through SVG file upload with filter bypass
- CVE-2026-32752FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages
- CVE-2026-28289FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
- CVE-2026-27636FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache
- CVE-2026-27637FreeScout's Predictable Authentication Token Enables Account Takeover
- CVE-2025-58163FreeScout's deserialization of untrusted data can lead to Remote Code Execution