FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes

The core impact of CVE-2026-41191 lies in the ability for a user with restricted permissions to alter critical mailbox settings. While the user interface only displays the signature field, a malicious actor can directly modify the chatstartnew setting via a POST request. This could lead to unintended chat behavior, potentially disrupting support workflows or enabling unauthorized communication channels. The blast radius is limited to the affected mailbox and its associated users, but the impact on support operations could be significant. This vulnerability highlights the importance of proper input validation and access control enforcement, even for seemingly innocuous settings.

Organizations utilizing FreeScout for help desk and shared mailbox management are at risk, particularly those running versions 1.0.0 through 1.8.214. Shared hosting environments where multiple users have access to FreeScout instances are also at increased risk, as the vulnerability could be exploited by a malicious user within the same hosting account.

• php: Examine FreeScout application logs for suspicious POST requests to MailboxesController::updateSave() with modified chatstartnew values.

grep 'chat_start_new' /path/to/freescout/logs/application.log

• generic web: Monitor access logs for requests to /api/v2/mailboxes/<mailboxid>/update with POST data containing chatstart_new.

grep 'chat_start_new' /var/log/apache2/access.log

• generic web: Check response headers for unusual status codes (e.g., 200 OK) after POST requests to the vulnerable endpoint, indicating successful modification.

1. 2026-04-21Disclosure

   disclosure

1. 已保留2026-04-18
2. 发布日期2026-04-21
3. EPSS 更新日期2026-04-29

The primary mitigation for CVE-2026-41191 is to upgrade FreeScout to version 1.8.215 or later, which includes the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary restrictions on direct POST requests to the MailboxesController::updateSave() endpoint. While not a complete solution, this can reduce the attack surface. Review FreeScout's access control configuration to ensure users only have the necessary permissions. After upgrading, verify the chatstartnew setting for all mailboxes to ensure it has not been maliciously altered.