CVE-2026-41190: FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when APPSHOWONLYASSIGNEDCONVERSATIONS is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The savedraft AJAX path is weaker. A direct POST can create a draft inside a conversation that is hidden in the UI. Version 1.8.215 fixes the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41190?
CVE-2026-41190 has a moderate severity level due to its ability to bypass visibility controls.
How do I fix CVE-2026-41190?
To fix CVE-2026-41190, upgrade to FreeScout version 1.8.215 or later.
What does CVE-2026-41190 exploit?
CVE-2026-41190 exploits a visibility bypass issue by allowing hidden conversation draft injection.
Which versions of FreeScout are affected by CVE-2026-41190?
FreeScout versions prior to 1.8.215 are affected by CVE-2026-41190.
What should I do if I'm still using a vulnerable version of FreeScout?
If using a vulnerable version of FreeScout, it is critical to upgrade to the latest version to mitigate the risk.