CVE-2026-85744
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
61/100
Published: 2026-11-06
Modified: 2026-11-12
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
Low
A:
Low
Description
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target's existing contents. This issue is fixed in version 1.8.227.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| freescout-help-desk | freescout | < 1.8.227 |
| freescout-help-desk | freescout | < 1.8.227 |