freescout.

FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

• freescout
• Cross-site scripting (XSS)
• CWE-116

FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

• freescout
• Denial of service

FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

• freescout
• Authentication bypass
• CWE-178

FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

• freescout
• Path traversal

FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471

• freescout
• Unrestricted file upload

FreeScout vulnerable to prototype pollution in getQueryParam

• freescout
• Prototype pollution

FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails

• freescout
• Authentication bypass

FreeScout Allows Unauthenticated Access to Legacy Attachment Files

• freescout
• Authentication bypass

FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint

• freescout
• Broken access control

FreeScout: User Account Enumeration via Password Reset Response Differentiation

• freescout
• Information disclosure
• CWE-204

FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path

• freescout
• Authentication bypass
• CWE-345

FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check

• freescout
• Broken access control

FreeScout: Thread Deletion Bypasses Mailbox Access Revocation

• freescout
• Broken access control

FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass

• freescout
• Broken access control

FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access

• freescout
• Server-side request forgery (SSRF)

FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip_tags validator with mixed text+HTML content

• freescout
• Cross-site scripting (XSS)

FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks

• freescout
• Authentication bypass

FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472)

• freescout
• Broken access control

FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable

• freescout
• Cross-site request forgery (CSRF)

FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE

• freescout
• Path traversal

FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments

• freescout
• Broken access control

FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes

• freescout
• Broken access control

FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection

• freescout
• Broken access control

FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads

• freescout
• Broken access control

FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations

• freescout
• Information disclosure

FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply

• freescout
• Broken access control

FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification

• freescout
• Broken access control

FreeScout's Customer AJAX Create Modifies Hidden Existing Customer

• freescout
• Broken access control

FreeScout has Customer Edit Cross-Mailbox Email Takeover

• freescout
• Broken access control

FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII

• freescout
• Broken access control

FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration

• freescout
• Broken access control

FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization

• freescout
• Cross-site scripting (XSS)
• CWE-116

FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables

• freescout
• CWE-116

FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints

• freescout
• Server-side request forgery (SSRF)

FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href

• freescout
• Cross-site scripting (XSS)

FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron

• freescout
• Information disclosure
• Broken access control

FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)

• freescout
• Cross-site scripting (XSS)

FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force

• freescout
• Weak cryptography or TLS
• CWE-340

FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration

• freescout
• Authentication bypass
• Broken access control

FreeScout Customer Merge Cross-Mailbox Authorization Bypass

• freescout
• Broken access control

FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout

• freescout
• Open redirect
• CWE-20

FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()

• freescout
• Server-side request forgery (SSRF)

FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})

• freescout
• Cross-site scripting (XSS)
• CWE-116

FreeScout: Stored XSS through SVG file upload with filter bypass

• freescout
• Cross-site scripting (XSS)

FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages

• freescout
• Broken access control

FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution

• freescout
• Unrestricted file upload

FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache

• freescout
• Unrestricted file upload

FreeScout's Predictable Authentication Token Enables Account Takeover

• freescout
• Weak cryptography or TLS

FreeScout's deserialization of untrusted data can lead to Remote Code Execution

• freescout
• Insecure deserialization

FreeScout's deserialization of untrusted data leads to Remote Code Execution

• freescout
• Insecure deserialization

FreeScout Vulnerable to Stored XSS

• freescout
• Cross-site scripting (XSS)

FreeScout has Race Condition When Deleting Users

• freescout
• Race condition

FreeScout Vulnerable to Stored XSS

• freescout
• Cross-site scripting (XSS)

FreeScout Vulnerable to Stored XSS

• freescout
• Cross-site scripting (XSS)

FreeScout Vulnerable to Stored XSS

• freescout
• Cross-site scripting (XSS)

FreeScout Vulnerable to Stored XSS

• freescout
• Cross-site scripting (XSS)

FreeScout Vulnerable to Stored XSS

• freescout
• Cross-site scripting (XSS)

FreeScout Vulnerable to Stored XSS

• freescout
• Cross-site scripting (XSS)

FreeScout Stored XSS leads to CSRF

• freescout
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)

FreeScout Has Business Logic Errors

• freescout
• CWE-841