PT-2026-26373 · Freescout+1 · Freescout+1

Offensiveee · Published 2026-03-19 · Updated 2026-03-24 · CVE-2026-32752

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions 1.8.208 and below

Description FreeScout is a help desk and shared inbox application built with the Laravel PHP framework. A broken access control issue exists in the ThreadPolicy::edit() method. This allows any authenticated user, regardless of their role or mailbox access, to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages and bypasses the entire mailbox permission model, potentially leading to GDPR compliance violations. The ThreadPolicy::edit() function is vulnerable to unauthorized access. The vulnerable parameter is not specified.

Recommendations Upgrade to version 1.8.209 or later to resolve this issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-32752

GHSA-WXG5-G9VV-V8G9

Affected Products

Freescout

Laravel

References · 9

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wxg5-g9vv-v8g9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32752.json · Exploit
• https://github.com/freescout-help-desk/freescout/commit/996a7f96337fdd8a1d1bbd0da0ec7ec85d160b11 · Patch
• https://osv.dev/vulnerability/CVE-2026-32752 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32752 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.209 · Note
• https://twitter.com/CVEnew/status/2034891630264676380 · Twitter Post
• https://twitter.com/infoflowcloud/status/2034893015651606973 · Twitter Post
• https://twitter.com/dailycve/status/2036275226451796391 · Twitter Post