CVE-2026-41183

MEDIUM

FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations

Title source: cna

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.

References (3)

Scores

CVSS v3 4.3
EPSS 0.0003
EPSS Percentile 7.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
freescout-help-desk/freescout < 1.8.215
Published Apr 21, 2026
Tracked Since Apr 21, 2026