Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-85742 | FreeScout: Conditional stored admin XSS via failed-job details | * | 7.5 | — | 2026-11-07 | |
| CVE-2026-103985 | FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction v... | * | 7.1 | — | 2026-11-07 | |
| CVE-2026-103984 | FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII | * | 6.5 | — | 2026-11-07 | |
| CVE-2026-85743 | FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks | * | 8.2 | — | 2026-11-07 | |
| CVE-2026-85744 | FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass | * | 5.4 | — | 2026-11-07 | |
| CVE-2026-62850 | FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumer... | * | 5.3 | — | 2026-11-07 | |
| CVE-2026-62852 | FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorizat... | * | 6.5 | — | 2026-11-07 | |
| CVE-2026-62855 | FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files | * | 4.4 | — | 2026-11-07 | |
| CVE-2026-62851 | FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortc... | * | 4.3 | — | 2026-11-07 | |
| CVE-2026-62856 | FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query | * | 7.7 | — | 2026-11-07 | |
| CVE-2026-62854 | FreeScout: Stored XSS in mailbox signature via same-origin JS upload | * | 7.6 | — | 2026-11-07 | |
| CVE-2026-107393 | FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header | * | 6.1 | — | 2026-10-09 | |
| CVE-2026-53596 | FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS) | * | 5.3 | — | 2026-07-21 | |
| CVE-2026-53595 | FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL | * | 9.4 | — | 2026-07-21 | |
| CVE-2026-53594 | FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path | * | 4.9 | — | 2026-07-21 | |
| CVE-2026-53593 | FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) —... | * | 8.8 | — | 2026-07-21 | |
| CVE-2026-53592 | FreeScout vulnerable to prototype pollution in getQueryParam | * | 4.6 | — | 2026-07-21 | |
| CVE-2026-53591 | FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails | * | 8.6 | — | 2026-07-21 | |
| CVE-2026-48812 | FreeScout Allows Unauthenticated Access to Legacy Attachment Files | * | 7.5 | — | 2026-07-21 | |
| CVE-2026-45295 | FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open... | * | 6.5 | — | 2026-07-21 | |
| CVE-2026-45294 | FreeScout: User Account Enumeration via Password Reset Response Differentiation | * | 5.3 | — | 2026-05-30 | |
| CVE-2026-47123 | FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path | * | 7.5 | — | 2026-05-30 | |
| CVE-2026-48810 | FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check | * | 4.3 | — | 2026-05-30 | |
| CVE-2026-48811 | FreeScout: Thread Deletion Bypasses Mailbox Access Revocation | * | 4.3 | — | 2026-05-30 | |
| CVE-2026-41906 | FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass | * | 7.1 | — | 2026-05-08 | |
| CVE-2026-41905 | FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing in... | * | 7.7 | — | 2026-05-08 | |
| CVE-2026-41904 | FreeScout Stored XSS vulnerability in mailbox auto-reply: payload reaches every customer's email client (no CS... | * | 7.6 | — | 2026-05-08 | |
| CVE-2026-41902 | FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leak... | * | 9.1 | — | 2026-05-08 | |
| CVE-2026-41903 | FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifying any user's notification subscriptions (incomple... | * | 5.4 | — | 2026-05-08 | |
| CVE-2026-41194 | FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable | * | 5.4 | — | 2026-04-22 | |
| CVE-2026-41193 | FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE | * | 9.1 | — | 2026-04-22 | |
| CVE-2026-41192 | FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments | * | 7.1 | — | 2026-04-22 | |
| CVE-2026-41191 | FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes | * | 7.1 | — | 2026-04-22 | |
| CVE-2026-41190 | FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection | * | 7.1 | — | 2026-04-22 | |
| CVE-2026-41189 | FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads | * | 7.1 | — | 2026-04-22 | |
| CVE-2026-41183 | FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations | * | 4.3 | — | 2026-04-22 | |
| CVE-2026-40592 | FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply | * | 5.9 | — | 2026-04-22 | |
| CVE-2026-40591 | FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modific... | * | 7.1 | — | 2026-04-22 | |
| CVE-2026-40590 | FreeScout's Customer AJAX Create Modifies Hidden Existing Customer | * | 4.3 | — | 2026-04-22 | |
| CVE-2026-40589 | FreeScout has Customer Edit Cross-Mailbox Email Takeover | * | 7.6 | — | 2026-04-22 | |
| CVE-2026-40570 | FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer... | * | 5.7 | — | 2026-04-22 | |
| CVE-2026-40569 | FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration | * | 9.0 | — | 2026-04-22 | |
| CVE-2026-40568 | FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization | * | 8.5 | — | 2026-04-22 | |
| CVE-2026-40567 | FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables | * | 5.8 | — | 2026-04-22 | |
| CVE-2026-40566 | FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints | * | 4.1 | — | 2026-04-22 | |
| CVE-2026-40565 | FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href | * | 6.1 | — | 2026-04-22 | |
| CVE-2026-40498 | FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron | * | 8.9 | — | 2026-04-22 | |
| CVE-2026-40497 | FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration) | * | 8.1 | — | 2026-04-21 | |
| CVE-2026-40496 | FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force | * | 8.8 | — | 2026-04-21 | |
| CVE-2026-35584 | FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation... | * | 6.9 | — | 2026-04-08 | |
| CVE-2026-39384 | FreeScout Customer Merge Cross-Mailbox Authorization Bypass | * | 7.6 | — | 2026-04-08 | |
| CVE-2026-34442 | FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout | * | 5.4 | — | 2026-04-01 | |
| CVE-2026-34443 | FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask() | * | 6.9 | — | 2026-04-01 | |
| CVE-2026-32754 | FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) | * | 9.3 | — | 2026-03-20 | |
| CVE-2026-32753 | FreeScout: Stored XSS through SVG file upload with filter bypass | * | 8.5 | — | 2026-03-20 | |
| CVE-2026-32752 | FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages | * | 0.0 | — | 2026-03-20 | |
| CVE-2026-28289 | FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Executio... | * | 10.0 | — | 2026-03-04 | |
| CVE-2026-27636 | FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache | * | 8.8 | — | 2026-02-25 | |
| CVE-2026-27637 | FreeScout's Predictable Authentication Token Enables Account Takeover | * | 9.8 | — | 2026-02-25 | |
| CVE-2025-58163 | FreeScout's deserialization of untrusted data can lead to Remote Code Execution | * | 8.6 | — | 2025-09-03 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).