CVE-2026-53591: FreeScout improper authentication in FetchEmails conversation injection

CVE-2026-53591 · Severity: high · CVSS 8.6 · Published 2026-07-20

FreeScout is an open-source help desk and shared inbox platform used by businesses to manage customer support communications. A security flaw allows unauthorized outsiders to inject fake messages into existing support tickets by sending a specially crafted email to the help desk's public address. This can lead to attackers impersonating customers, reopening closed tickets, and potentially tricking support agents into disclosing sensitive information or taking unauthorized actions.

Quick answers

Is CVE-2026-53591 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53591 being exploited in the wild.
How severe is CVE-2026-53591?
High severity, with a CVSS score of 8.6, published 20 July 2026.
Which products and versions are affected?
freescout-help-desk FreeScout < 1.8.223.
Is there a fix for CVE-2026-53591?
A patch was published on 2026-07-20: Version 1.8.223 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53591 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53591?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass exists in the FetchEmails artisan command of FreeScout due to an insecure backward compatibility check. The application attempts to verify the authenticity of incoming email replies using a 16-character HMAC hash in the In-Reply-To header; however, if the provided hash is any length other than 16, the verification logic is skipped entirely, accepting the thread ID as-is. An unauthenticated remote attacker can exploit this by sending an email with a malformed header (e.g., a single-character hash) to inject arbitrary content into any conversation, as thread IDs are sequential and easily guessed. This results in the conversation being reopened and the attacker's message being rendered as a legitimate customer reply in the agent UI. The vulnerability is fixed in version 1.8.223 by removing the insecure backward compatibility branch.

Affected products

  • freescout-help-desk FreeScout < 1.8.223

Timeline

  • 2026-06-10: advisory: GitHub Security Advisory published
  • 2026-07-20: disclosed: CVE published to NVD
  • 2026-07-20: patched: Version 1.8.223 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.