CVE-2026-103985
FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.
| CWE | CWE-269 CWE-284 |
| Vendor | freescout-help-desk |
| Product | freescout |
| Published | Nov 6, 2026 |
| Last Updated | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for freescout-help-desk freescout
Be the first to know when new high vulnerabilities affecting freescout-help-desk freescout are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
freescout-help-desk / freescout
< 1.8.231