# CVE-2026-48810: FreeScout improper authorization in ThreadPolicy edit method

Source: https://junglewise.ai/threats/cve-2026-48810-freescout-improper-authorization-in-threadpolicy-edit-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-48810 · Severity: medium · CVSS 4.3 · Published 2026-05-29

FreeScout is an open-source help desk and shared inbox platform. A security flaw allows former staff members to modify messages or internal notes they previously wrote, even after their access to a specific mailbox has been revoked by an administrator. This could allow a disgruntled or former employee to alter the audit trail of customer communications or internal records without authorization.

Technologies: [FreeScout Help Desk FreeScout](https://junglewise.ai/threats/technologies/freescout). Vendors: [FreeScout Help Desk](https://junglewise.ai/threats/vendors/freescout-help-desk).

## Quick answers

**Is CVE-2026-48810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48810 being exploited in the wild.

**How severe is CVE-2026-48810?** Medium severity, with a CVSS score of 4.3, published 29 May 2026.

**Which products and versions are affected?** FreeScout Help Desk FreeScout < 1.8.221.

**Is there a fix for CVE-2026-48810?** A patch was published on 2026-05-29: Vulnerability fixed in version 1.8.221 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48810 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48810?** Check whether you run FreeScout Help Desk FreeScout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability exists in the ThreadPolicy::edit method of FreeScout. While the application checks if a user is the author of a thread and has the general 'PERM_EDIT_CONVERSATIONS' permission, it fails to verify if the user still maintains active membership/access to the specific mailbox containing that thread for certain message types (TYPE_MESSAGE and TYPE_NOTE). An attacker with low-privileged credentials who previously had access to a mailbox can send a crafted POST request to the AJAX endpoint to overwrite thread content. This bypasses the intended access control logic where removal from a mailbox should terminate all interaction rights. The issue is resolved in version 1.8.221 by adding a 'userHasAccessToMailbox' check to the affected policy branch.

## Affected products

- FreeScout FreeScout < 1.8.221

## Timeline

- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: NVD publication date
- 2026-05-29: patched: Vulnerability fixed in version 1.8.221

## References

- [https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-3w38-h42v-3h6w](https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-3w38-h42v-3h6w)

## Related threats

- [FreeScout missing authorization in internal note deletion](https://junglewise.ai/threats/cve-2026-48811-freescout-missing-authorization-in-internal-note-deletion)
- [FreeScout agent impersonation via missing HMAC in notification replies](https://junglewise.ai/threats/cve-2026-47123-freescout-agent-impersonation-via-missing-hmac-in-notification)
- [FreeScout account enumeration in password reset endpoint](https://junglewise.ai/threats/cve-2026-45294-freescout-account-enumeration-in-password-reset-endpoint)
- [FreeScout SSRF via broken CIDR check in checkIpByMask](https://junglewise.ai/threats/cve-2026-34443-freescout-ssrf-via-broken-cidr-check-in-checkipbymask)
- [FreeScout host header injection in absolute URL generation](https://junglewise.ai/threats/cve-2026-34442-freescout-host-header-injection-in-absolute-url-generation)