CVE-2026-40592
FreeScout is a free self-hosted help desk and shared mailbox.
Published Apr 21, 2026 · updated Jun 17, 2026
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route checks only whether the current user can view the parent conversation. It does not verify that the current user created the reply being undone. In a shared mailbox, one agent can therefore recall another agent's just-sent reply during the 15-second undo window. Version 1.8.214 fixes the vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 21, 2026 · NIST NVD
Detected
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route checks only whether the current user can view the parent conversation. It does not verify that the current user created the reply being undone. In a shared mailbox, one agent can therefore recall another agent's just-sent reply during the 15-second undo window. Version 1.8.214 fixes the vuln
Jun 17, 2026 · NIST NVD
Updated
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route checks only whether the current user can view the parent conversation. It does not verify that the current user created the reply being undone. In a shared mailbox, one agent can therefore recall another agent's just-sent reply during the 15-second undo window. Version 1.8.214 fixes the vuln
Sources
- CVE.orgVulnerability recordCVE-2026-40592
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40592
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route checks only whether the current user can view the parent conversation. It does not verify that the current user created the reply
nvd.nist.gov