Vulnerability in FreeScout Help Desk with Trust Issues in Attachment Handling
CVE-2026-41192
7.1HIGH
What is CVE-2026-41192?
FreeScout, a self-hosted help desk solution, is susceptible to improper input validation in its attachment handling functionality. Prior to the release of version 1.8.215, the application accepted client-supplied encrypted attachment IDs without sufficient verification. This flaw allows a malicious user to exploit the system by decrypting and manipulating these IDs. Specifically, an attacker can replay IDs from the 'attachments_all[]' array during a draft save operation, potentially leading to unauthorized deletion of original attachment files from the mailbox. The vulnerability has been addressed in the update to version 1.8.215.
Affected Version(s)
freescout < 1.8.215