# CVE-2026-47123: FreeScout agent impersonation via missing HMAC in notification replies

Source: https://junglewise.ai/threats/cve-2026-47123-freescout-agent-impersonation-via-missing-hmac-in-notification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-47123 · Severity: high · CVSS 7.5 · Published 2026-05-29

FreeScout is an open-source help desk and shared inbox platform. A security flaw in how the system processes incoming emails allows an attacker to impersonate a help desk agent. By sending a specially crafted email, an attacker can inject messages into existing support threads that appear to be legitimate replies from staff. These forged messages are then automatically forwarded to customers through the organization's official email server, which could be used to conduct highly convincing phishing attacks or distribute malicious links under the guise of official support.

Technologies: [FreeScout Help Desk FreeScout](https://junglewise.ai/threats/technologies/freescout). Vendors: [FreeScout Help Desk](https://junglewise.ai/threats/vendors/freescout-help-desk).

## Quick answers

**Is CVE-2026-47123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47123 being exploited in the wild.

**How severe is CVE-2026-47123?** High severity, with a CVSS score of 7.5, published 29 May 2026.

**Which products and versions are affected?** FreeScout Help Desk FreeScout < 1.8.220.

**Is there a fix for CVE-2026-47123?** A patch was published on 2026-05-29: Fix released in version 1.8.220 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47123 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47123?** Check whether you run FreeScout Help Desk FreeScout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `FetchEmails` command's `processMessage()` function. While the customer reply path correctly implements HMAC verification using the `APP_KEY`, the notification reply path (`notify-{thread_id}-{user_id}-...`) extracts the `thread_id` and `user_id` directly from the `In-Reply-To` or `References` headers without any cryptographic verification. An attacker who knows a valid `thread_id` and an agent's email address can spoof the `From` address and craft a `Message-ID` that matches the vulnerable regex. Because FreeScout does not perform SPF/DKIM/DMARC validation on incoming mail, it processes these forged emails as legitimate agent replies and triggers the `UserReplied` event, causing the `SendReplyToCustomer` job to forward the attacker's content to the customer via the legitimate SMTP server. This issue is fixed in version 1.8.220.

## Affected products

- FreeScout FreeScout < 1.8.220

## Timeline

- 2026-05-19: advisory: GitHub Security Advisory GHSA-6r38-6mcf-2ww3 published
- 2026-05-29: disclosed: CVE-2026-47123 published to NVD
- 2026-05-29: patched: Fix released in version 1.8.220

## References

- [https://github.com/freescout-help-desk/freescout/commit/d902f19038213c6a376947d269b00440908e88a0](https://github.com/freescout-help-desk/freescout/commit/d902f19038213c6a376947d269b00440908e88a0)
- [https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6r38-6mcf-2ww3](https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6r38-6mcf-2ww3)

## Related threats

- [FreeScout missing authorization in internal note deletion](https://junglewise.ai/threats/cve-2026-48811-freescout-missing-authorization-in-internal-note-deletion)
- [FreeScout improper authorization in ThreadPolicy edit method](https://junglewise.ai/threats/cve-2026-48810-freescout-improper-authorization-in-threadpolicy-edit-method)
- [FreeScout account enumeration in password reset endpoint](https://junglewise.ai/threats/cve-2026-45294-freescout-account-enumeration-in-password-reset-endpoint)
- [FreeScout SSRF via broken CIDR check in checkIpByMask](https://junglewise.ai/threats/cve-2026-34443-freescout-ssrf-via-broken-cidr-check-in-checkipbymask)
- [FreeScout host header injection in absolute URL generation](https://junglewise.ai/threats/cve-2026-34442-freescout-host-header-injection-in-absolute-url-generation)