FreeScout missing access checks expose other users' conversations
Other people's support conversations can be read in FreeScout.
Summary
Missing access checks in FreeScout, a help desk application, can expose conversation content, notifications and attachment details across users and mailboxes. People who run it on their own servers are affected.
Affected when
- guest session with a valid CSRF token
- logged-in agent who belongs to at least one mailbox
- logged-in user restricted to seeing only assigned conversations
What to do
Update to version 1.8.226 or later.
Products and platforms
CVE IDs
Sources
Times
First published
First seen