CVE-2026-41191

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, `MailboxesController::updateSave()` persists `chat_start_new` outside the allowed-field filter. A user with only the mailbox `sig` permission sees only the signature field in the UI, but can still change the hidden mailbox-wide chat setting via direct POST. Version 1.8.215 fixes the vulnerability.

PUBLISHED Reserved 2026-04-18 | Published 2026-04-21 | Updated 2026-04-21 | Assigner GitHub_M

Problem types

CWE-863: Incorrect Authorization

Product status

References

github.com/...escout/security/advisories/GHSA-wpv9-c2gv-2j82

github.com/...ommit/fb130de64e1c830d85dd6988eaa08d725a7be954

github.com/...scout-help-desk/freescout/releases/tag/1.8.215

cve.org (CVE-2026-41191)

nvd.nist.gov (CVE-2026-41191)

Download JSON