FreeScout is a self-hosted PHP/Laravel helpdesk and shared-inbox application. The vulnerabilities catalogued here were found during an automated audit of FreeScout's codebase and validated against a Docker deployment, then disclosed through GitHub Security Advisories.
All issues are fixed in 1.8.217. If you self-host FreeScout, upgrade.
| CVE | Severity | Class | Auth Required | One-line |
|---|---|---|---|---|
| CVE-2026-41902 | Critical 9.1 | Insufficient Session Expiration (CWE-613) | None | Invite link → permanent unauthenticated account takeover |
| CVE-2026-41903 | Moderate 5.4 | Incorrect Authorization (CWE-863) | Low-priv user with PERM_EDIT_USERS |
Mute/alter any user's notifications, including admins |
| CVE-2026-41904 | High 7.6 | Cross-site Scripting (CWE-79) | Mailbox manager | Stored XSS in auto-reply, fired in external customers' mail clients |
| CVE-2026-41905 | High 7.7 | SSRF (CWE-918) | Low-priv user (or unauth via inbound email) | Redirect-validation bypass → cloud metadata, internal HTTP |
- Affected: all FreeScout versions
< 1.8.217 - Fixed:
1.8.217 - Patch commit range: see each individual write-up
- Disclosure window: discovered 2026-04-17/18, GHSAs published with the patched release, public write-ups published after.
A few patterns recur across these four findings — they are the kind of thing that's worth grepping your own Laravel codebase for:
- Validate-then-store, don't store-then-render-raw. CVE-2026-41904 validates a
strip_tags()-massaged copy but persists the original string, which is later rendered with{!! ... !!}. The validator and the sink looked at different values. - Incomplete fixes leave variant CVEs. CVE-2026-41903 reuses
UserPolicy@update, the same overly-broad policy that CVE-2025-48472 was intended to repair — but only on the controller methods touched in the original fix. Sibling controller actions kept the bug. - Validation must follow the data, not the variable name. CVE-2026-41905 follows HTTP redirects with cURL but re-validates the original URL after the redirect, not the final destination — a one-line variable-swap mistake with full SSRF impact.
- Time-bounded artifacts need timestamps. CVE-2026-41902 is a 60-character invite hash with no
invite_sent_at, no TTL, and no rate limit. Once leaked anywhere — referer header, forwarded mail, log file — it stays usable for years.
Found and reported by @whatisproblem, with the web-vuln-agent automated audit pipeline doing the initial surface-mapping and Docker validation.
Thanks to the FreeScout maintainers (@freescout-help-desk) for the prompt triage and patch turnaround on all four reports.