FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads

The impact of this vulnerability is significant, as it allows an attacker to directly modify customer interactions within the FreeScout help desk. An attacker could alter support tickets, change customer information, or inject malicious content into conversations. This could lead to reputational damage, legal liabilities, and potentially compromise sensitive customer data. The ability to edit customer-authored threads circumvents the intended access controls, enabling unauthorized modifications to the support process. While the vulnerability doesn't grant full system access, the impact on customer support operations and data integrity is considerable.

Organizations using FreeScout for customer support, particularly those relying on shared mailbox functionality, are at risk. This includes small to medium-sized businesses (SMBs) and larger enterprises utilizing FreeScout as a lightweight help desk solution. Shared hosting environments running FreeScout are also at increased risk due to potential cross-tenant vulnerabilities.

• php / web: Examine FreeScout access logs for unusual thread editing activity, especially from users with limited permissions. Look for requests to /api/v1/threads/{thread_id}/edit originating from unauthorized users.

 grep "/api/v1/threads/.*edit" access.log

• php / web: Check FreeScout configuration files for any misconfigured access control settings related to thread editing. • generic web: Monitor FreeScout instances for unexpected changes in conversation content or customer data. • generic web: Review FreeScout user roles and permissions to ensure proper access controls are in place.

1. 2026-04-21Disclosure

   disclosure

1. 予約済み2026-04-18
2. 公開日2026-04-21
3. EPSS 更新日2026-04-29

The primary mitigation for CVE-2026-41189 is to upgrade FreeScout to version 1.8.215 or later. If an immediate upgrade is not feasible due to compatibility issues or downtime constraints, consider implementing temporary workarounds. While no direct WAF rules can prevent this, restricting access to the thread editing endpoints based on user roles and permissions can provide a limited layer of defense. Regularly review user access logs for suspicious activity, particularly edits made by users who should not have access to specific conversations. After upgrading, confirm the fix by attempting to edit a conversation thread with a user account that should not have editing privileges; the attempt should be denied.