FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…escout/security/advisories/GHSA-m4hc-rc98-38jc Diğer
• github.com/…ommit/83030464eec3c03712ad988b81f069b372c45399 Diğer
• github.com/…scout-help-desk/freescout/releases/tag/1.8.231 Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:11Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-85742FreeScout: Conditional stored admin XSS via failed-job details
• 6,5 CVE-2026-103984FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII
• 8,2 CVE-2026-85743FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks
• 5,4 CVE-2026-85744FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass
• 5,3 CVE-2026-62850FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration a…
• 6,5 CVE-2026-62852FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key