CVE-2026-53591
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Vulnerability in FreeScout before version 1.8.223. An unauthenticated attacker can inject a message into any existing support conversation by sending an email with a crafted In-Reply-To header. The message appears as a customer reply, and the conversation is automatically reopened.
Risk Assessment
Risk of impersonating a customer and injecting false information into support conversations, potentially leading to agent misinformation or data leakage.
Recommendation
Upgrade FreeScout to version 1.8.223.
Other vulnerabilities in FreeScout
See all- CVE-2026-41906High
FreeScout is a free help desk and shared inbox built with the Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers, but the backend conversation_change_customer action accepts any supplied customer_email.
- CVE-2026-41905High
FreeScout prior to version 1.8.217 had a vulnerability in the Helper::sanitizeRemoteUrl() function that improperly validated URLs after HTTP redirects. An attacker could exploit this vulnerability to redirect traffic to internal HTTP services that would normally be blocked.
- CVE-2026-41904High
FreeScout prior to version 1.8.217 allows users with updateAutoReply permission to store an XSS payload in the auto-reply message. The payload is rendered unescaped in the auto-reply email sent to customers.
- CVE-2026-53595Critical
In FreeScout before version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` allows an attacker to take over a user account without authentication. The vulnerability is due to trailing space equality in MySQL/MariaDB VARCHAR and improper decryption of the `invite_sent_at` parameter.
- CVE-2026-41902Critical
FreeScout prior to version 1.8.217 has a vulnerability in the /user-setup/{hash} endpoint that accepts a 60-character random invite_hash to set a new user's password. The lack of expiration check allows for unauthorized account takeover long after the invite was issued.
- CVE-2026-53596Medium
FreeScout, a free help desk built with Laravel, does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.
- CVE-2026-53594Medium
FreeScout prior to version 1.8.224 has a vulnerability in the App Logs feature that allows an authenticated attacker to download arbitrary server-local files readable by the PHP process via manipulation of the dl parameter.
- CVE-2026-53593High
FreeScout before version 1.8.224 has an incomplete denylist of dangerous file extensions, missing the .pht extension. An authenticated agent can upload a .pht web shell, leading to remote code execution on the web server.
- CVE-2026-53592Medium
A Prototype Pollution vulnerability in the getQueryParam function in /public/js/main.js in FreeScout. The fix in version 1.8.139 is incomplete, allowing attacks via nested URL keys. Fixed in version 1.8.223.
- CVE-2026-48812High
Vulnerability in FreeScout (versions prior to 1.8.221) in the attachment download mechanism. An unauthenticated attacker can download any attachment created by an older version because token authentication is skipped for attachments with legacy token type.
Original NVD description (English source)
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted `In-Reply-To` header. No credentials, tokens, or prior access are required. The injected message is rendered in the agent UI as a legitimate customer reply, the conversation is automatically reopened, and the `last_reply_from` field is set to the attacker's identity. Version 1.8.223 contains a fix.