CVE-2026-41192: FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment IDs. Any IDs present in attachmentsall[] but omitted from retained lists are decrypted and passed directly to Attachment::deleteByIds(). Because loadattachments returns encrypted IDs for attachments on a visible conversation, a mailbox peer can replay those IDs through savedraft and delete the original attachment row and file. Version 1.8.215 fixes the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41192?
CVE-2026-41192 is categorized as a high severity vulnerability due to the risk of unauthorized deletion of conversation attachments.
How do I fix CVE-2026-41192?
To fix CVE-2026-41192, upgrade FreeScout to version 1.8.215 or later.
What does CVE-2026-41192 affect?
CVE-2026-41192 affects FreeScout versions prior to 1.8.215 by exploiting client-controlled attachment IDs.
What is the potential impact of CVE-2026-41192?
The potential impact of CVE-2026-41192 is that unauthorized users can delete existing conversation attachments.
Is CVE-2026-41192 publicly known?
Yes, CVE-2026-41192 is a publicly known vulnerability, affecting multiple users of the affected FreeScout version.