CVE-2026-103985: FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save

Published Nov 6, 2026

Updated

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the onlyassignedtickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERMONLYASSIGNEDTICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeScout to a version that resolves this vulnerability.
Fixed in 1.8.231

Event History

Nov 6, 2026

CVE Published

via MITRE·05:11 PM

Data Sourced

via MITRE·05:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A non-administrative agent whose account has been restricted to viewing only conversations assigned to them can exploit it. The agent must already belong to the mailbox containing the conversations they want to access.

Does exploitation require a special configuration or complex attack?

No. The affected profile form exposes the restriction to its non-admin owner, so the agent can remove it by unchecking the option or by performing a normal profile save that omits it.

What access does a successful attacker gain?

The agent can read and modify conversations assigned to other agents in every mailbox to which that agent already belongs. The issue does not provide access to mailboxes the agent is not a member of.

How can we determine whether an account may be affected?

Check whether the deployment is older than 1.8.231 and whether non-admin agents have been configured with the "see only assigned conversations" restriction. Such agents may be able to remove that restriction through their own profile settings.

What should be done if immediate upgrading is not possible?

Do not rely on the "see only assigned conversations" setting to enforce separation between agents on affected versions. Restrict access by mailbox membership and review restricted agents' profiles and conversation access until upgrading to 1.8.231 is possible.

CVE-2026-103985: FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require a special configuration or complex attack?

What access does a successful attacker gain?

How can we determine whether an account may be affected?

What should be done if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require a special configuration or complex attack?

What access does a successful attacker gain?

How can we determine whether an account may be affected?

What should be done if immediate upgrading is not possible?