PT-2026-34027 · Freescout Help Desk · Freescout

Published 2026-04-21 · Updated 2026-04-27 · CVE-2026-40592

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.214

Description The undo-send route "/conversation/undo-reply/{thread id}" only verifies if the current user has permission to view the parent conversation. It fails to confirm that the user attempting the action is the one who created the reply. In a shared mailbox environment, this allows one agent to recall a reply sent by another agent within the 15-second undo window.

Recommendations Update to version 1.8.214.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40592

Affected Products

Freescout

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-40592 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.214 · Note
• https://github.com/freescout-help-desk/freescout/commit/c779afdda86fa00a4b85779e034bbfd9ce20c76d · Note
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-674v-r6xp-mvp6 · Note
• https://twitter.com/CVEnew/status/2048910160912085410 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048911673155518870 · Twitter Post