CVE-2026-32752

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages (evidence tampering), bypasses the entire mailbox permission model, and constitutes a GDPR/compliance violation. The issue has been fixed in version 1.8.209.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
freescout-help-desk	freescout	< 1.8.209

References

https://github.com/freescout-help-desk/freescout/commit/996a7f96337fdd8a1d1bbd0da0ec7ec85d160b11Patch
https://github.com/freescout-help-desk/freescout/releases/tag/1.8.209Product, Release Notes
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wxg5-g9vv-v8g9Exploit, Mitigation, Vendor Advisory

Timeline

Published: Mar 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-327535.4FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, bypasses of the attachment CVE-2026-327549.3FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross CVE-2026-327555.7Admidio is an open-source user management solution. In versions 5.0.6 and below, the save_membership action in modules/profile/profile_funct CVE-2026-327568.8Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in th CVE-2026-327575.4Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST['ecard_message'] v CVE-2026-327586.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Ver CVE-2026-327598.1File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In CVE-2026-32766.3unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining charac CVE-2026-327609.8File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In CVE-2026-327616.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Ver CVE-2026-327626.5Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_val CVE-2026-327638.2Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path comp