CVE-2026-41192: FreeScout Auth Bypass Vulnerability

CVE-2026-41192 Overview

CVE-2026-41192 is a Missing Authorization vulnerability (CWE-862) affecting FreeScout, a free self-hosted help desk and shared mailbox application. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs without proper authorization verification. Any IDs present in attachments_all[] but omitted from retained lists are decrypted and passed directly to Attachment::deleteByIds(). Because load_attachments returns encrypted IDs for attachments on a visible conversation, a mailbox peer can replay those IDs through save_draft and delete the original attachment row and file, leading to unauthorized data modification and potential data loss.

Critical Impact

Authenticated users with mailbox access can delete attachments belonging to other conversations, causing data integrity issues and potential loss of critical support ticket documentation.

Affected Products

• FreeScout versions prior to 1.8.215
• Self-hosted FreeScout help desk installations
• FreeScout shared mailbox deployments

Discovery Timeline

• 2026-04-21 - CVE-2026-41192 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-41192

Vulnerability Analysis

This vulnerability stems from a Missing Authorization flaw in how FreeScout handles attachment management during reply and draft operations. The application fails to properly verify that a user has authorization to perform deletion operations on specific attachments before processing the request.

When a user saves a draft or replies to a conversation, the application processes attachment IDs provided by the client. The vulnerable code path accepts encrypted attachment IDs through the attachments_all[] parameter. When certain IDs are omitted from the retained attachment lists, FreeScout decrypts these IDs and passes them directly to Attachment::deleteByIds() without verifying that the requesting user owns or has permission to delete those attachments.

The load_attachments function returns encrypted IDs for attachments associated with any visible conversation within the mailbox. This design allows an attacker with mailbox access to observe attachment IDs from other conversations and replay them through the save_draft endpoint, effectively deleting attachments they should not have access to modify.

Root Cause

The root cause is a broken access control implementation where the application trusts client-supplied attachment identifiers without performing proper authorization checks. The encryption of attachment IDs provides only obscurity, not actual security, since any authenticated user with mailbox access can obtain valid encrypted IDs through the load_attachments function. The deletion logic fails to verify attachment ownership or conversation association before executing the delete operation.

Attack Vector

The attack is network-based and requires low-privileged authenticated access to a FreeScout mailbox. An attacker who is a legitimate mailbox peer can exploit this vulnerability through the following process:

1. Access a conversation within their mailbox to trigger load_attachments, which returns encrypted attachment IDs for visible conversations
2. Capture the encrypted attachment IDs from conversations belonging to other users or different threads
3. Craft a malicious save_draft request that includes the target attachment IDs in attachments_all[] but deliberately omits them from the retained attachments list
4. Submit the request, causing the application to decrypt the IDs and delete the targeted attachments without authorization verification

No user interaction is required beyond the attacker having authenticated access to a shared mailbox. The attack can result in permanent deletion of attachment files and database records.

Detection Methods for CVE-2026-41192

Indicators of Compromise

• Unexpected deletion of attachments from conversations where the associated user did not perform the action
• Audit log entries showing attachment deletions initiated through save_draft endpoints by users without conversation ownership
• Discrepancies between conversation attachment counts and actual stored files
• User complaints about missing attachments in support tickets they did not modify

Detection Strategies

• Monitor application logs for save_draft requests that result in attachment deletions, particularly where the attachment belongs to a different conversation than the draft
• Implement anomaly detection for users deleting attachments at unusual rates or from conversations they haven't previously accessed
• Review database audit trails for Attachment::deleteByIds() operations where the calling user lacks ownership of the attachment's parent conversation
• Deploy web application firewall rules to flag suspicious patterns in attachments_all[] parameter manipulation

Monitoring Recommendations

• Enable detailed logging for all attachment-related operations including creation, modification, and deletion with full user context
• Configure alerts for attachment deletions that occur outside normal user workflow patterns
• Implement integrity monitoring for attachment storage directories to detect unexpected file deletions
• Establish baseline metrics for attachment deletion rates per user and alert on anomalies

How to Mitigate CVE-2026-41192

Immediate Actions Required

• Upgrade FreeScout to version 1.8.215 or later immediately
• Review attachment deletion logs for any suspicious activity prior to patching
• Restore any critical attachments from backup if unauthorized deletions are detected
• Temporarily restrict mailbox access to trusted users until the patch is applied if immediate upgrade is not possible

Patch Information

FreeScout has addressed this vulnerability in version 1.8.215. The fix implements proper authorization checks before processing attachment deletion requests. Organizations running affected versions should upgrade immediately by obtaining the patched release from the official FreeScout GitHub repository.

The specific security fix can be reviewed in the GitHub commit. Additional details are available in the GitHub Security Advisory GHSA-cv36-2j23-x6g3.

Workarounds

• Implement network-level access controls to limit FreeScout access to trusted IP ranges until patching is complete
• Review and restrict mailbox membership to only essential personnel to reduce the attack surface
• Configure web application firewall rules to inspect and potentially block suspicious save_draft requests with unusual attachment ID patterns
• Enable comprehensive logging and monitoring to detect exploitation attempts while awaiting patch deployment

# Upgrade FreeScout to patched version
cd /var/www/freescout
git fetch --all
git checkout tags/1.8.215
php artisan freescout:after-app-update