CVE-2026-41191: FreeScout Auth Bypass Vulnerability

CVE-2026-41191 Overview

CVE-2026-41191 is an Improper Authorization vulnerability (CWE-863) affecting FreeScout, a free self-hosted help desk and shared mailbox application. Prior to version 1.8.215, the MailboxesController::updateSave() function improperly persists the chat_start_new parameter outside of the allowed-field filter. This authorization bypass allows users with limited mailbox permissions to modify hidden mailbox-wide chat settings via direct POST requests, circumventing the intended access control restrictions.

Critical Impact

A user with only the mailbox sig (signature) permission can manipulate hidden chat configuration settings across the entire mailbox, potentially disrupting chat workflows and undermining access control boundaries for all mailbox users.

Affected Products

• FreeScout versions prior to 1.8.215
• FreeScout Help Desk self-hosted deployments with multiple user permission levels
• FreeScout installations utilizing the chat feature with restricted user roles

Discovery Timeline

• 2026-04-21 - CVE-2026-41191 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-41191

Vulnerability Analysis

This vulnerability stems from an Improper Authorization flaw in FreeScout's mailbox settings controller. The MailboxesController::updateSave() method fails to properly validate and filter incoming POST parameters against the user's actual permission level. While the user interface correctly hides fields that users should not access based on their assigned permissions, the backend controller does not enforce these same restrictions when processing form submissions.

In FreeScout's permission model, users can be granted granular access to specific mailbox features. A user assigned only the sig permission should only be able to modify their signature settings. However, due to the missing server-side authorization check, the chat_start_new parameter is processed and persisted even when submitted by users without the appropriate chat management permissions.

Root Cause

The root cause is insufficient server-side authorization validation in the MailboxesController::updateSave() method. The application relies on client-side UI restrictions to hide unauthorized fields rather than implementing proper server-side filtering based on user permissions. The chat_start_new parameter was not included in the allowed-field filter that should restrict which parameters each permission level can modify. This creates a classic Broken Access Control scenario where the security model is enforced only at the presentation layer.

Attack Vector

The attack can be executed remotely over the network by any authenticated user with minimal mailbox permissions. An attacker with only the sig permission would:

1. Authenticate to the FreeScout application with a low-privilege account
2. Navigate to the mailbox settings page where they have limited access
3. Intercept or craft a direct POST request to the mailbox update endpoint
4. Include the chat_start_new parameter in the POST body with a malicious value
5. Submit the request, bypassing UI restrictions to modify the mailbox-wide chat setting

This attack requires low privileges (authenticated user with sig permission) and no user interaction, making it straightforward to exploit. The vulnerability allows modification of settings that affect all users of the mailbox, extending the impact beyond the attacker's authorized scope.

Detection Methods for CVE-2026-41191

Indicators of Compromise

• Unexpected modifications to mailbox chat_start_new settings without corresponding admin activity
• POST requests to mailbox update endpoints containing chat_start_new parameter from users with only sig permissions
• Audit log entries showing chat configuration changes by users without chat management privileges
• Discrepancies between user permission levels and the settings they have modified

Detection Strategies

• Implement web application firewall rules to flag POST requests containing chat_start_new parameters from sessions with limited permissions
• Review application access logs for parameter tampering attempts on mailbox settings endpoints
• Deploy endpoint detection to monitor for automated tools crafting custom POST requests to FreeScout
• Enable verbose logging on the MailboxesController::updateSave() endpoint to capture all parameter submissions

Monitoring Recommendations

• Configure alerts for mailbox setting changes by users without full administrative access
• Implement real-time monitoring of POST parameters submitted to sensitive configuration endpoints
• Establish baseline behavior for each permission level and alert on deviations
• Review FreeScout audit logs regularly for unauthorized configuration modifications

How to Mitigate CVE-2026-41191

Immediate Actions Required

• Upgrade FreeScout to version 1.8.215 or later immediately
• Audit recent mailbox configuration changes to identify any unauthorized modifications
• Review user permissions and temporarily restrict access for accounts that may have been compromised
• Enable detailed logging on mailbox update endpoints to detect exploitation attempts

Patch Information

The vulnerability has been addressed in FreeScout version 1.8.215. The fix ensures that the chat_start_new parameter is properly included in the allowed-field filter, preventing users without appropriate permissions from modifying this setting. The patch is available via the GitHub Release 1.8.215. Technical details of the fix can be reviewed in the GitHub Commit Update. Additional information is available in the GitHub Security Advisory GHSA-wpv9-c2gv-2j82.

Workarounds

• Implement a web application firewall rule to block POST requests containing chat_start_new parameter from non-admin users
• Temporarily revoke mailbox sig permissions from untrusted users until the patch can be applied
• Add custom middleware to validate user permissions against submitted parameters before processing
• Monitor and audit all mailbox configuration changes as an interim detection measure
• Consider restricting network access to FreeScout administrative endpoints to trusted IP ranges

# Example: Verify FreeScout version after upgrade
cd /path/to/freescout
php artisan freescout:version
# Expected output should show version 1.8.215 or higher