FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron

FreeScout's Predictable Authentication Token Enables Account Takeover

FreeScout Has Business Logic Errors

FreeScout Vulnerable to Arbitrary File Upload

FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})

FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks

FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE

FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force

FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration

FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471

FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache

FreeScout's deserialization of untrusted data can lead to Remote Code Execution

FreeScout's deserialization of untrusted data leads to Remote Code Execution

FreeScout Has Business Logic Errors

FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails

FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization

FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration)

FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages

FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution

FreeScout Has Business Logic Errors

FreeScout Vulnerable to Insufficient Authorization

FreeScout Vulnerable to Insufficient Authorization

FreeScout Vulnerable to Insufficient Authorization

FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access

FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CSP), bypassing strip_tags validator with mixed text+HTML content

FreeScout has Customer Edit Cross-Mailbox Email Takeover

FreeScout Customer Merge Cross-Mailbox Authorization Bypass

FreeScout Allows Unauthenticated Access to Legacy Attachment Files

FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path

FreeScout Vulnerable to Remote Code Execution (RCE)

FreeScout Vulnerable to Deserialization of Untrusted Data

FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass

FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments

FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes

FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection

FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads

FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification

FreeScout has Race Condition When Deleting Users

FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint

FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration

FreeScout Has Insufficient Protection Against CRLF-injection

FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href

FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout

FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply

FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables

FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII

FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomplete fix of CVE-2025-48472)

FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable