CVE-2026-41191
FreeScout is a free self-hosted help desk and shared mailbox.
Published Apr 21, 2026 · updated Jun 17, 2026
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, persists outside the allowed-field filter. A user with only the mailbox permission sees only the signature field in the UI, but can still change the hidden mailbox-wide chat setting via direct POST. Version 1.8.215 fixes the vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 21, 2026 · NIST NVD
Detected
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, persists outside the allowed-field filter. A user with only the mailbox permission sees only the signature field in the UI, but can still change the hidden mailbox-wide chat setting via direct POST. Version 1.8.215 fixes the vulnerability.
Jun 17, 2026 · NIST NVD
Updated
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, persists outside the allowed-field filter. A user with only the mailbox permission sees only the signature field in the UI, but can still change the hidden mailbox-wide chat setting via direct POST. Version 1.8.215 fixes the vulnerability.
Sources
- CVE.orgVulnerability recordCVE-2026-41191
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41191
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, persists outside the allowed-field filter. A user with only the mailbox permission sees only the signature field in the UI, but can s
nvd.nist.gov