CVE-2026-103985

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.

• CWE-269
• CWE-284

• https://github.com/freescout-help-desk/freescout/commit/83030464eec3c03712ad988b81f069b372c45399
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103966Adobe Framemaker is affected by a Heap-based Buffer Overflow…7.8
• CVE-2026-103967Adobe Framemaker is affected by an out-of-bounds write vulne…7.8
• CVE-2026-103974lichess.org is the forever free, adless and open source ches…5.4
• CVE-2026-103975Appium is a cross-platform automation framework for all kind…6.5
• CVE-2026-103977FileRise is a self-hosted web-based file manager with multi-…8.1
• CVE-2026-103984FreeScout is a self-hosted help desk and shared mailbox. Pri…6.5
• CVE-2026-103988FileRise is a self-hosted web-based file manager with multi-…5.4
• CVE-2026-103993An Out-of-bounds Write vulnerability in the routing protocol…6.8
• CVE-2026-103994A Heap-based Buffer Overflow vulnerability in the VXLAN Gate…8.8
• CVE-2026-103995Response body and chunk parsing would handle non-hex or nega…2
• CVE-2026-103996The If-So Dynamic Content – Elementor & All Page Builders Pe…6.4
• CVE-2026-103997The Redux Framework plugin for WordPress is vulnerable to au…6.5