CVE-2026-103985 · Other
NO FIX YET · SEE WHAT TO DO
FreeScout is a self-hosted help desk where a non-admin agent can remove the administrator-set restriction that limits them to their own assigned tickets. Once removed, the agent can read and change conversations assigned to other agents in mailboxes they already belong to.
first public Aug 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted FreeScout installations below 1.8.231 where some agents are restricted to only their assigned tickets. Any non-admin agent with a profile form can exploit it against conversations in mailboxes they already belong to. Installations without restricted agents, or that are already on 1.8.231 or later, are not affected.
Not affected if fixed-version, no-restricted-agents
Who cares freescout, help-desk, self-hosted
1.8.231 are affected.1.8.231FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.