FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply

The primary impact of this vulnerability is the potential disruption of communication within a shared mailbox environment. An attacker, posing as a legitimate agent, could maliciously recall replies sent by other agents, potentially deleting important messages or creating confusion. This could lead to missed customer inquiries, delayed responses, and a negative impact on customer service. While the vulnerability window is limited to 15 seconds, the potential for disruption and misuse exists, particularly in environments with multiple agents accessing the same mailbox.

Organizations utilizing FreeScout with shared mailbox configurations are at risk. This includes businesses relying on shared inboxes for customer support, sales, or other collaborative communication purposes. The vulnerability is particularly relevant to deployments with multiple agents accessing the same mailbox, as it enables one agent to impact the work of others.

• nodejs / server:

  grep -r 'conversation/undo-reply/{thread_id}' /opt/freescout/app/routes/

• generic web:

  curl -I 'http://your-freescout-instance/conversation/undo-reply/123' # Check for 200 OK response without authentication

1. 2026-04-21Disclosure

   disclosure

1. Reservado2026-04-14
2. Publicada2026-04-21
3. EPSS atualizado2026-04-29

The recommended mitigation for CVE-2026-40592 is to immediately upgrade FreeScout to version 1.8.214 or later. If upgrading is not immediately feasible, consider implementing stricter access controls within the shared mailbox to limit the ability of agents to recall messages. While a direct workaround is not available, monitoring the 'undo-reply' endpoint for unusual activity could provide early detection. After upgrading, confirm the fix by attempting to recall a reply sent by another user; the action should be denied.