Quick answers
- Is CVE-2026-48810 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48810 being exploited in the wild.
- How severe is CVE-2026-48810?
- Medium severity, with a CVSS score of 4.3, published 29 May 2026.
- Which products and versions are affected?
- FreeScout Help Desk FreeScout < 1.8.221.
- Is there a fix for CVE-2026-48810?
- A patch was published on 2026-05-29: Vulnerability fixed in version 1.8.221 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48810 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-48810?
- Check whether you run FreeScout Help Desk FreeScout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An improper authorization vulnerability exists in the ThreadPolicy::edit method of FreeScout. While the application checks if a user is the author of a thread and has the general 'PERM_EDIT_CONVERSATIONS' permission, it fails to verify if the user still maintains active membership/access to the specific mailbox containing that thread for certain message types (TYPE_MESSAGE and TYPE_NOTE). An attacker with low-privileged credentials who previously had access to a mailbox can send a crafted POST request to the AJAX endpoint to overwrite thread content. This bypasses the intended access control logic where removal from a mailbox should terminate all interaction rights. The issue is resolved in version 1.8.221 by adding a 'userHasAccessToMailbox' check to the affected policy branch.
Affected products
- FreeScout FreeScout < 1.8.221
Timeline
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: NVD publication date
- 2026-05-29: patched: Vulnerability fixed in version 1.8.221