PT-2026-26373 · Freescout+1 · Freescout+1

Offensiveee · Publicado 2026-03-19 · Atualizado 2026-03-24 · CVE-2026-32752

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions 1.8.208 and below

Description FreeScout is a help desk and shared inbox application built with the Laravel PHP framework. A broken access control issue exists in the ThreadPolicy::edit() method. This allows any authenticated user, regardless of their role or mailbox access, to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages and bypasses the entire mailbox permission model, potentially leading to GDPR compliance violations. The ThreadPolicy::edit() function is vulnerable to unauthorized access. The vulnerable parameter is not specified.

Recommendations Upgrade to version 1.8.209 or later to resolve this issue.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-32752

GHSA-WXG5-G9VV-V8G9

Produtos afetados

Freescout

Laravel

Referências · 9

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wxg5-g9vv-v8g9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32752.json · Exploit
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.209 · Nota
• https://github.com/freescout-help-desk/freescout/commit/996a7f96337fdd8a1d1bbd0da0ec7ec85d160b11 · Correção
• https://osv.dev/vulnerability/CVE-2026-32752 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034891630264676380 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32752 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2034893015651606973 · Publicação no Twitter
• https://twitter.com/dailycve/status/2036275226451796391 · Publicação no Twitter