CVE-2026-41183

Published: Apr 21, 2026Modified: Jun 17, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://github.com/freescout-help-desk/freescout/commit/6583d6f5a593b51223904f9e0f2e721e63c76de0

Source: security-advisories@github.com

https://github.com/freescout-help-desk/freescout/releases/tag/1.8.215

Source: security-advisories@github.com

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-7rh8-9rgv-g35r

Source: security-advisories@github.com

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-7rh8-9rgv-g35r

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.