CVE-2026-41190
FreeScout is a free self-hosted help desk and shared mailbox.
Published Apr 21, 2026 · updated Jun 17, 2026
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The AJAX path is weaker. A direct POST can create a draft inside a conversation that is hidden in the UI. Version 1.8.215 fixes the vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 21, 2026 · NIST NVD
Detected
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The AJAX path is weaker. A direct POST can create a draft inside a conversation that is hidden in the UI. Version 1.8.215 fixes the vulnerability.
Jun 17, 2026 · NIST NVD
Updated
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The AJAX path is weaker. A direct POST can create a draft inside a conversation that is hidden in the UI. Version 1.8.215 fixes the vulnerability.
Sources
- CVE.orgVulnerability recordCVE-2026-41190
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41190
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The AJAX path is weaker. A di
nvd.nist.gov