CVE-2026-41192

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs. Any IDs present in "attachmentsall" but omitted from retained lists are decrypted and passed directly to "Attachment::deleteByIds"...

CVE-2026-41190

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when "APPSHOWONLYASSIGNEDCONVERSATIONS" is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The "savedraft" AJAX path is weaker. A direct POST can create a...

CVE-2026-41192: Missing Authorization

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs. Any IDs present in attachmentsall but omitted from retained lists are decrypted and passed directly to Attachment::deleteByIds. Because...

CVE-2026-41190: Incorrect Authorization

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when APPSHOWONLYASSIGNEDCONVERSATIONS is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The savedraft AJAX path is weaker. A direct POST can create a dra...