PT-2026-34030 · Freescout · Freescout

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-41190

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.215

Description When the APP SHOW ONLY ASSIGNED CONVERSATIONS setting is enabled, the system correctly restricts access to conversation views for users who are not the creator or the assignee. However, the 'save draft' AJAX path lacks sufficient validation, allowing a direct POST request to create a draft within a conversation that should be hidden in the user interface.

Recommendations Update to version 1.8.215.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-41190

Affected Products

Freescout

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-41190 · Security Note
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-vj2p-2789-3747 · Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.215 · Note
• https://github.com/freescout-help-desk/freescout/commit/414878eb79be7cb01a3ae124df6efcd23729275f · Note
• https://twitter.com/infoflowcloud/status/2046676573936398807 · Twitter Post
• https://twitter.com/CVEnew/status/2046675017530778104 · Twitter Post