CVE-2026-41183: FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations
Published Apr 21, 2026
·Updated
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.
Affected Software
1 affected component
Freescout freescout<1.8.215
Event History
Apr 21, 2026
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-41183?
CVE-2026-41183 is classified as a medium severity vulnerability.
2
How do I fix CVE-2026-41183?
To fix CVE-2026-41183, upgrade FreeScout to version 1.8.215 or later.
3
What does CVE-2026-41183 affect?
CVE-2026-41183 affects FreeScout versions prior to 1.8.215.
4
What type of information could be disclosed due to CVE-2026-41183?
CVE-2026-41183 could disclose assigned-only hidden conversations to unauthorized users.
5
Is there a patch available for CVE-2026-41183?
Yes, a patch is included in the FreeScout version 1.8.215 release.