CVE-2026-41903

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user holding the PERM_EDIT_USERS permission (intended for general user-profile editing) can read and modify the notification subscriptions of any other user, including admins, by sending a single POST request. This is a sibling of CVE-2025-48472's notification authorization bypass — the prior fix did not cover this code path. A non-admin attacker can silently disable an admin's email/browser/mobile notifications, suppressing security alerts and conversation-assignment notices. This issue has been patched in version 1.8.217.

• CWE-863

• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-f489-qxv6-gvgg

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41898rust-openssl provides OpenSSL bindings for the Rust programm…5.3
• CVE-2026-41899Coolify is an open-source and self-hostable tool for managin…6.5
• CVE-2026-4190A vulnerability was detected in JawherKl node-api-postgres u…7.3
• CVE-2026-41900OpenLearnX is an open-source, decentralized learning and ass…10
• CVE-2026-41901Thymeleaf is a server-side Java template engine for web and …9
• CVE-2026-41902FreeScout is a free help desk and shared inbox built with PH…9.1
• CVE-2026-41904FreeScout is a free help desk and shared inbox built with PH…7.6
• CVE-2026-41905FreeScout is a free help desk and shared inbox built with PH…7.7
• CVE-2026-41906FreeScout is a free help desk and shared inbox built with PH…7.1
• CVE-2026-41907uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs…7.5
• CVE-2026-41908OpenClaw before 2026.4.20 contains a scope enforcement bypas…6.5
• CVE-2026-41909OpenClaw before 2026.4.20 contains an improper authorization…5.4