CVE-2026-41192

Summary: FreeScout before version 1.8.215 is vulnerable. The bug arises in the reply/draft flows that trust client-supplied encrypted attachment IDs. When an attachment ID that appears in attachments_all[] but is not in the retained lists is decrypted and passed to Attachment::deleteByIds(), a ma...