FreeScout versions prior to 1.8.213 are vulnerable to Server-Side Request Forgery (SSRF) and arbitrary HTML injection in outgoing emails, which could allow attackers to exploit the system.

🚨 EUVD-2026-24167 📊 Score: 4.1/10 (CVSS v3.1) 📦 Product: freescout 🏢 Vendor: freescout-help-desk 📅 Updated: 2026-04-21 📝 FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a Server-Side Request Forgery (SSRF) vulnerability in the IMAP/SMTP connection test functionality of FreeScout's `MailboxesController`. Three AJAX acti... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24167 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24168 📊 Score: 5.8/10 (CVSS v3.1) 📦 Product: freescout 🏢 Vendor: freescout-help-desk 📅 Updated: 2026-04-21 📝 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can inject arbitrary HTML into outgoing emails generated by FreeScout by sending an email with a crafted From display name. The ... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24168 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24187 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: freescout 🏢 Vendor: freescout-help-desk 📅 Updated: 2026-04-21 📝 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the phone-conversation creation flow accepts attacker-controlled `customer_id`, `name`, `to_email`, and `phone` values and resolves the target customer in t... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24187 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24189 📊 Score: 5.9/10 (CVSS v3.1) 📦 Product: freescout 🏢 Vendor: freescout-help-desk 📅 Updated: 2026-04-21 📝 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks only whether the current user can view the parent conversation. It does not verify tha... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24189 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24191 📊 Score: 4.3/10 (CVSS v3.1) 📦 Product: freescout 🏢 Vendor: freescout-help-desk 📅 Updated: 2026-04-21 📝 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX fi... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24191 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24193 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: freescout 🏢 Vendor: freescout-help-desk 📅 Updated: 2026-04-21 📝 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, customer-thread editing is authorized through `ThreadPolicy::edit()`, which checks mailbox access but does not apply the assigned-only restriction from `Con... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24193 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24195 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: freescout 🏢 Vendor: freescout-help-desk 📅 Updated: 2026-04-21 📝 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when `APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS` is enabled, direct conversation view correctly blocks users who are neither the assignee nor the creator. The `s... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24195 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-24197 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: freescout 🏢 Vendor: freescout-help-desk 📅 Updated: 2026-04-21 📝 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, `MailboxesController::updateSave()` persists `chat_start_new` outside the allowed-field filter. A user with only the mailbox `sig` permission sees only the ... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24197 #cybersecurity #infosec #euvd #cve #vulnerability