CVE-2026-41189: Authorization Bypass in FreeScout

The impact of this vulnerability is significant, as it allows an attacker to directly modify customer interactions within the FreeScout help desk. An attacker could alter support tickets, change customer information, or inject malicious content into conversations. This could lead to reputational damage, legal liabilities, and potentially compromise sensitive customer data. The ability to edit customer-authored threads circumvents the intended access controls, enabling unauthorized modifications to the support process. While the vulnerability doesn't grant full system access, the impact on customer support operations and data integrity is considerable.

1. Reserved2026-04-18
2. Published2026-04-21
3. EPSS updated2026-04-29

The primary mitigation for CVE-2026-41189 is to upgrade FreeScout to version 1.8.215 or later. If an immediate upgrade is not feasible due to compatibility issues or downtime constraints, consider implementing temporary workarounds. While no direct WAF rules can prevent this, restricting access to the thread editing endpoints based on user roles and permissions can provide a limited layer of defense. Regularly review user access logs for suspicious activity, particularly edits made by users who should not have access to specific conversations. After upgrading, confirm the fix by attempting to edit a conversation thread with a user account that should not have editing privileges; the attempt should be denied.