CVE-2026-41906 Details
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers through the mailbox-filtered search endpoint, but the backend conversation_change_customer action accepts any supplied customer_email. A low-privileged agent can forge a request and bind a visible conversation to a hidden customer in another mailbox. This issue has been patched in version 1.8.214.
An authorization bypass vulnerability has been identified in FreeScout versions prior to 1.8.214. The issue arises in the Change Customer modal, which correctly filters out-of-scope customers through the mailbox-filtered search endpoint. However, the backend conversation_change_customer action accepts any customer_email, allowing a low-privileged agent to forge a request. This exploitation can bind a visible conversation to a hidden customer in another mailbox.
Users are advised to update FreeScout to version 1.8.214 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 7, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-p6hg-2cwg-rrx9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/freescout-help-desk/freescout/releases/tag/1.8.214 | [email protected] | Release NotesVendor |
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-p6hg-2cwg-rrx9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FreeScout | < 1.8.214 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |