FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target's existing contents. This issue is fixed in version 1.8.227.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…escout/security/advisories/GHSA-v8vc-cmf9-gg2c Diğer
• github.com/…ommit/7c485c96bef7188c276906200250ce9d8a2bdfeb Diğer
• github.com/…scout-help-desk/freescout/releases/tag/1.8.227 Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:05Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-85742FreeScout: Conditional stored admin XSS via failed-job details
• 7,1 CVE-2026-103985FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
• 6,5 CVE-2026-103984FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII
• 8,2 CVE-2026-85743FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks
• 5,3 CVE-2026-62850FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration a…
• 6,5 CVE-2026-62852FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key