CVE-2026-41194: FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the mailbox OAuth disconnect action is implemented as GET /mailbox/oauth-disconnect/{id}/{inout}/{provider}. It removes stored OAuth metadata from the mailbox and then redirects. Because it is a GET route, no CSRF token is required and the action can be triggered cross-site against a logged-in mailbox admin. Version 1.8.215 fixes the vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41194?
CVE-2026-41194 is considered a medium severity vulnerability due to its potential for CSRF attacks.
How do I fix CVE-2026-41194?
To fix CVE-2026-41194, upgrade FreeScout to version 1.8.215 or later, which addresses the issue.
What does CVE-2026-41194 affect?
CVE-2026-41194 affects versions of FreeScout prior to 1.8.215, specifically concerning the mailbox OAuth disconnect functionality.
What is the nature of the vulnerability in CVE-2026-41194?
CVE-2026-41194 involves the misuse of a state-changing GET request that is susceptible to cross-site request forgery (CSRF) attacks.
Is CVE-2026-41194 exploitable remotely?
Yes, CVE-2026-41194 is exploitable remotely as it involves a GET request vulnerable to CSRF from an authorized user's session.