CVE-2026-48810

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, while investigating the ThreadPolicy::delete issue reported previously, the same missing mailbox membership check was found in the sibling ThreadPolicy::edit method. A user with the PERM_EDIT_CONVERSATIONS permission who created a message or internal note in Mailbox A can rewrite that thread's body after an administrator removes them from Mailbox A, because the policy checks only authorship and a global permission flag — not current mailbox membership. This vulnerability is fixed in 1.8.221.

• CWE-285

• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-3w38-h42v-3h6w
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-3w38-h42v-3h6w

Published

May 29, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48805Twig is a template language for PHP. Prior to 3.27.0, deprec…9.1
• CVE-2026-48806Twig is a template language for PHP. Prior to 3.27.0, ArrayE…9.1
• CVE-2026-48807Twig is a template language for PHP. Prior to 3.27.0, the sa…9.1
• CVE-2026-48808Twig is a template language for PHP. Prior to 3.27.0, the co…7.5
• CVE-2026-48809python-engineio is a Python implementation of the Engine.IO …7.5
• CVE-2026-4881In affected versions of Octopus Server, permissions were not…6.5
• CVE-2026-48811FreeScout is a free help desk and shared inbox built with PH…4.3
• CVE-2026-48812FreeScout is a free help desk and shared inbox built with PH…7.5
• CVE-2026-48813Flawfinder is a a static analysis tool for finding vulnerabi…8.7
• CVE-2026-48814Network-AI is a TypeScript/Node.js multi-agent orchestrator.…9.1
• CVE-2026-48815sigstore-js provides JavaScript libraries for interacting wi…7.5
• CVE-2026-48816sigstore-js provides JavaScript libraries for interacting wi…6.5