CVE-2026-48811: FreeScout Auth Bypass Vulnerability

CVE-2026-48811 Overview

CVE-2026-48811 is a missing authorization vulnerability [CWE-862] in FreeScout, a PHP Laravel-based help desk and shared inbox application. Versions prior to 1.8.221 allow a non-admin user to permanently delete internal notes (private threads) from any conversation, even after that user's access to the mailbox containing the conversation has been revoked. The ThreadPolicy::delete authorization policy does not validate mailbox membership before granting destructive write access. A former team member retains the ability to delete notes they authored, resulting in loss of audit history and operational data. The issue is fixed in FreeScout 1.8.221.

Critical Impact
Former or off-boarded FreeScout users can permanently delete internal notes from mailboxes they no longer have access to, causing irreversible loss of conversation history.

Affected Products

FreeScout versions prior to 1.8.221
FreeScout self-hosted help desk deployments
FreeScout instances with revoked but not deleted user accounts

Discovery Timeline

2026-05-29 - CVE-2026-48811 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-48811

Vulnerability Analysis

FreeScout implements per-action authorization using Laravel policy classes. The ThreadPolicy class governs who may create, update, or delete a Thread, which represents a message or internal note within a conversation. The delete method on this policy returns true based on the relationship between the user and the thread author, without re-validating that the user still belongs to the mailbox owning the parent conversation.

Internal notes are private threads visible only to mailbox members. When an administrator removes a user from a mailbox, the user loses read access to its conversations through other authorization paths. However, the delete policy continues to authorize destructive operations against threads the user previously created. This produces a horizontal authorization gap where data destruction privileges outlive the underlying access grant.

The vulnerability requires a valid authenticated session, network access to the application, and prior knowledge of (or stored references to) thread identifiers. Successful exploitation removes the targeted note from the conversation and audit trail.

Root Cause

The root cause is incomplete authorization logic in ThreadPolicy::delete. The policy checks thread ownership but omits a mailbox membership check against the conversation's parent mailbox. This violates the principle that authorization decisions must reflect current entitlements, not historical ones.

Attack Vector

An attacker with a previously valid FreeScout account whose mailbox access has been revoked authenticates to the application. Using cached or previously enumerated thread IDs, the attacker issues a delete request against the thread endpoint. The flawed policy returns an allow decision and the note is permanently removed.

The vulnerability is described in prose only because no public proof-of-concept code has been released. See the GitHub Security Advisory for the upstream technical description.

Detection Methods for CVE-2026-48811

Indicators of Compromise

Thread deletion events in FreeScout application logs originating from users who are no longer assigned to the mailbox containing the conversation.
Unexpected gaps in internal note sequences within conversations, particularly notes authored by recently off-boarded staff.
HTTP DELETE or POST requests to thread deletion routes from session tokens belonging to users without active mailbox membership.

Detection Strategies

Audit FreeScout database threads table soft-delete or removal timestamps and correlate the actor user_id against current mailbox membership in the mailbox_user table.
Enable Laravel request logging and alert on thread delete actions where the authenticated user does not appear in the conversation's mailbox roster.
Review web server access logs for delete-route hits from accounts that have been removed from any mailbox in the preceding 90 days.

Monitoring Recommendations

Forward FreeScout application and web server logs to a centralized SIEM for retention and correlation.
Create alerts on any thread deletion activity performed by accounts flagged as off-boarded or recently modified.
Track changes to mailbox membership and pair each membership revocation with a review of historical activity by the affected account.

How to Mitigate CVE-2026-48811

Immediate Actions Required

Upgrade FreeScout to version 1.8.221 or later, which corrects the ThreadPolicy::delete authorization check.
Identify users whose mailbox access has been revoked but whose accounts remain active, and disable those accounts until the upgrade is applied.
Review thread deletion history for unauthorized activity by off-boarded users and restore from backup where required.

Patch Information

The FreeScout maintainers fixed this vulnerability in release 1.8.221. The patch adds a mailbox membership check to the thread deletion authorization path. Refer to the FreeScout GHSA-9vx8-gx3p-9mh6 advisory for upstream release details.

Workarounds

Fully delete user accounts rather than only removing mailbox assignments when staff leave or change roles.
Restrict network access to the FreeScout application so that only current employees on trusted networks can reach the delete endpoints.
Take frequent database backups of the threads and conversations tables to allow recovery of notes deleted through this flaw.

bash

# Upgrade FreeScout to the patched release
cd /var/www/freescout
php artisan freescout:after-app-update
git fetch --tags
git checkout 1.8.221
php artisan migrate --force
php artisan freescout:clear-cache