FreeScoutのMailbox OAuth切断はステートを変更するGETを使用しており、CSRF可能です

The primary impact of this CSRF vulnerability lies in the potential for unauthorized OAuth disconnects. An attacker could craft a malicious link or embed it in a website that, when visited by a logged-in FreeScout mailbox administrator, would silently disconnect their OAuth integration. This could disrupt email flow, prevent access to external services, or potentially expose sensitive data if the OAuth integration grants access to other systems. While the vulnerability doesn't directly lead to remote code execution, the resulting disruption and potential data exposure represent a significant risk, particularly in environments where FreeScout is integrated with critical business applications. The blast radius extends to any user relying on the compromised OAuth integration.

1. 予約済み2026-04-18
2. 公開日2026-04-21
3. 更新日2026-04-22
4. EPSS 更新日2026-04-29

The recommended mitigation for CVE-2026-41194 is to immediately upgrade FreeScout to version 1.8.215 or later. If upgrading is not immediately feasible due to compatibility concerns or system downtime restrictions, consider implementing a temporary workaround by restricting access to the /mailbox/oauth-disconnect/{id}/{in_out}/{provider} endpoint. This can be achieved through firewall rules or access control lists, limiting access to trusted administrators only. Additionally, implement strict input validation and output encoding practices throughout the application to prevent future CSRF vulnerabilities. After upgrading, confirm the fix by attempting to trigger an OAuth disconnect action from a different browser session without being logged in to FreeScout; the action should be denied.