CVE-2026-47123: FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two code paths for identifying agent (user) replies based on In-Reply-To / References headers. The notification reply path (notify-{threadid}-{userid}-...) extracts threadid and userid directly from the Message-ID without HMAC verification. An external attacker who can spoof the From address of a helpdesk agent can inject messages that FreeScout processes as legitimate agent replies — which are then automatically forwarded to customers via the legitimate SMTP server. This vulnerability is fixed in 1.8.220.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeScoutto a version that resolves this vulnerability.Fixed in 1.8.220
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47123?
CVE-2026-47123 has a high severity rating of 7.5.
How do I fix CVE-2026-47123?
To fix CVE-2026-47123, you should upgrade to FreeScout version 1.8.220 or later.
What is the impact of CVE-2026-47123?
CVE-2026-47123 allows for agent impersonation due to missing HMAC verification on notification reply messages.
Which versions of FreeScout are affected by CVE-2026-47123?
CVE-2026-47123 affects FreeScout versions prior to 1.8.220.
What type of vulnerability is CVE-2026-47123?
CVE-2026-47123 is an agent impersonation vulnerability related to insufficient verification of Notification Reply Message-ID.