CVE-2026-41191: FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, MailboxesController::updateSave() persists chatstartnew outside the allowed-field filter. A user with only the mailbox sig permission sees only the signature field in the UI, but can still change the hidden mailbox-wide chat setting via direct POST. Version 1.8.215 fixes the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41191?
CVE-2026-41191 is classified as a medium severity vulnerability due to its potential for unauthorized mailbox setting changes.
How do I fix CVE-2026-41191?
To fix CVE-2026-41191, upgrade FreeScout to version 1.8.215 or later.
What types of changes can be made using the CVE-2026-41191 vulnerability?
CVE-2026-41191 allows unauthorized users to change chat-related settings within mailboxes.
In which version of FreeScout was CVE-2026-41191 fixed?
CVE-2026-41191 was fixed in FreeScout version 1.8.215.
Who is affected by CVE-2026-41191?
Users of FreeScout versions prior to 1.8.215 are affected by CVE-2026-41191.