Executive brief
FreeScout is an open-source help desk and shared inbox platform used by businesses to manage customer support communications. A security flaw allows unauthorized outsiders to inject fake messages into existing support tickets by sending a specially crafted email to the help desk's public address. This can lead to attackers impersonating customers, reopening closed tickets, and potentially tricking support agents into disclosing sensitive information or taking unauthorized actions.
Technical details
An authentication bypass exists in the FetchEmails artisan command of FreeScout due to an insecure backward compatibility check. The application attempts to verify the authenticity of incoming email replies using a 16-character HMAC hash in the In-Reply-To header; however, if the provided hash is any length other than 16, the verification logic is skipped entirely, accepting the thread ID as-is. An unauthenticated remote attacker can exploit this by sending an email with a malformed header (e.g., a single-character hash) to inject arbitrary content into any conversation, as thread IDs are sequential and easily guessed. This results in the conversation being reopened and the attacker's message being rendered as a legitimate customer reply in the agent UI. The vulnerability is fixed in version 1.8.223 by removing the insecure backward compatibility branch.
Affected products
- freescout-help-desk FreeScout < 1.8.223
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD
- 2026-07-20: patched: Version 1.8.223 released with fix