PT-2026-44993 · Freescout · Freescout

Fr0Z863Xf · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-47123

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.220

Description The email processing pipeline in the FetchEmails command contains two code paths for identifying agent replies using In-Reply-To and References headers. The notification reply path (notify-thread id-user id-...) extracts the thread id and user id directly from the Message-ID without HMAC (Hash-based Message Authentication Code) verification. This allows an external attacker to spoof the From address of a helpdesk agent and inject messages that are processed as legitimate agent replies, which are then automatically forwarded to customers via the legitimate SMTP server.

Recommendations Update to version 1.8.220.

Exploit

Fix

Authentication Bypass by Spoofing

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-290

CWE-345

Related Identifiers

CVE-2026-47123

Affected Products

Freescout

References · 6

• 🔥 https://vincent.vulcoord.net/score/?state=Not+Scored&year=2026&year=2025&assigned_to=a165dae3-480e-4f7d-bbb8-9b1d78115b69&cve=CVE-2026-47123&analyze=1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47123 · Security Note
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6r38-6mcf-2ww3 · Note
• https://github.com/freescout-help-desk/freescout/commit/d902f19038213c6a376947d269b00440908e88a0 · Note
• https://t.me/CVEtracker/55308 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2060489352187203849 · Twitter Post