FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…escout/security/advisories/GHSA-w668-wq26-6c94 Diğer
• github.com/…ommit/e47a54a5af6c57181ef99711326f5886e940b776 Diğer
• github.com/…scout-help-desk/freescout/releases/tag/1.8.226 Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:03Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-85742FreeScout: Conditional stored admin XSS via failed-job details
• 7,1 CVE-2026-103985FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
• 6,5 CVE-2026-103984FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII
• 8,2 CVE-2026-85743FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks
• 5,4 CVE-2026-85744FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass
• 5,3 CVE-2026-62850FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration a…