FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection

The primary impact of CVE-2026-41190 lies in the potential for unauthorized data manipulation within the FreeScout system. An attacker, leveraging the weakness in the save_draft endpoint, can create draft conversations that are hidden from regular users. This could be used to inject malicious content, mislead support agents, or disrupt the normal workflow of the help desk. While the drafts are not directly visible, they can still be accessed and potentially modified by administrators or other privileged users, leading to a compromise of data integrity. The blast radius is limited to the FreeScout instance itself, but the impact on the organization's support operations and data security could be significant.

1. आरक्षित2026-04-18
2. प्रकाशित2026-04-21
3. EPSS अद्यतन2026-04-29

The most effective mitigation for CVE-2026-41190 is to immediately upgrade FreeScout to version 1.8.215 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a temporary workaround by restricting direct access to the save_draft AJAX endpoint. This can be achieved through web application firewall (WAF) rules or proxy configurations that block unauthorized POST requests to that specific path. Carefully review FreeScout's access control mechanisms to ensure that only authorized users can access and modify draft conversations. After upgrading, confirm the vulnerability is resolved by attempting to create a draft conversation as a non-assignee/creator user and verifying that the draft is not created.