CVE-2026-41192 Details
Description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs. Any IDs present in `attachments_all[]` but omitted from retained lists are decrypted and passed directly to `Attachment::deleteByIds()`. Because `load_attachments` returns encrypted IDs for attachments on a visible conversation, a mailbox peer can replay those IDs through `save_draft` and delete the original attachment row and file. Version 1.8.215 fixes the vulnerability.
A vulnerability in FreeScout prior to version 1.8.215 allows for the deletion of attachments through client-supplied encrypted attachment IDs. The issue arises because the application trusts these IDs without proper validation. When an attachment is uploaded, its encrypted ID is returned and can be intercepted by a mailbox peer. This peer can then replay the ID to delete the original attachment from the conversation, exploiting the lack of ownership checks and permissions for deletion.
Users should update to FreeScout version 1.8.215 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 21, 2026CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/freescout-help-desk/freescout/commit/5f182818e2391f8e711fec6ae6648ac0b367bef5 | [email protected] | Source CodeVendor |
| https://github.com/freescout-help-desk/freescout/releases/tag/1.8.215 | [email protected] | Release NotesVendor |
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cv36-2j23-x6g3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FreeScout | < 1.8.215 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |