{"id":"CVE-2026-103985","kind":"vulnerability","aliases":["CVE-2026-103985"],"related":[],"title":"FreeScout: restricted agents can lift their own ticket-visibility limit","description":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.","summary":"FreeScout is a self-hosted help desk where a non-admin agent can remove the administrator-set restriction that limits them to their own assigned tickets. Once removed, the agent can read and change conversations assigned to other agents in mailboxes they already belong to.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freescout","help-desk","other","self-hosted"],"not_affected_if":["fixed-version","no-restricted-agents"],"how_to_check":"- Check the installed FreeScout version; the sources say versions before `1.8.231` are affected.\n- Review which users have the 'only assigned tickets' restriction and whether non-admin agents can edit their own profile.","fix":"- FreeScout: upgrade to `1.8.231`","status":"open","published_at":"2026-11-06T17:17:10+00:00","first_seen_at":"2026-11-06T17:43:11+00:00","triaged_at":"2026-11-06T17:45:12+00:00","updated_at":"2026-11-06T17:45:12+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-06T17:45:12Z","model":"claude-haiku-5-5","output":{"fix":"- FreeScout: upgrade to `1.8.231`","reach":"network","title":"FreeScout: restricted agents can lift their own ticket-visibility limit","impact":"medium","summary":"FreeScout is a self-hosted help desk where a non-admin agent can remove the administrator-set restriction that limits them to their own assigned tickets. Once removed, the agent can read and change conversations assigned to other agents in mailboxes they already belong to.","audience":"businesses","category":"other","nicknames":[],"who_cares":["freescout","self-hosted","help-desk"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Restricted agent reads and modifies other agents' assigned conversations","analyst_note":"","how_to_check":"- Check the installed FreeScout version; the sources say versions before `1.8.231` are affected.\n- Review which users have the 'only assigned tickets' restriction and whether non-admin agents can edit their own profile.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-restricted-agents"],"who_is_affected":"Self-hosted FreeScout installations below 1.8.231 where some agents are restricted to only their assigned tickets. Any non-admin agent with a profile form can exploit it against conversations in mailboxes they already belong to. Installations without restricted agents, or that are already on 1.8.231 or later, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4358,"output_tokens":531,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103985':14A,17A '-2026':13A,16A '1.8.231':86C,169C 'add':105C 'admin':38B,100C 'administr':44B,120C,141C 'administrator-impos':140C 'administrator-set':43B 'agent':3A,39B,58B,67B,123C,145C,155C 'alreadi':71B,160C 'assign':53B,64B,93C,111C,152C 'belong':72B,161C 'chang':62B 'check':114C 'convers':63B,151C 'cve':12A,15A 'desk':21B,33B,80C 'editor':117C 'everi':157C 'expos':90C 'fix':166C 'form':89C 'freescout':1A,18B,26B,73C 'help':20B,32B,79C 'help-desk':19B 'host':25B,31B,78C 'impos':142C 'issu':164C 'lift':5A 'limit':11A,48B 'mailbox':69B,83C,158C 'modifi':150C 'non':37B,99C 'non-admin':36B,98C 'omit':135C 'option':127C 'ordinari':131C 'owner':101C 'perm':109C 'permiss':95C 'prior':84C 'profil':88C,132C 'profilesav':104C 'read':60B,148C 'remov':41B,56B,107C,138C 'restrict':2A,46B,122C,143C 'save':133C 'self':24B,30B,77C 'self-host':23B,29B,76C 'set':45B 'share':82C 'submit':129C 'ticket':9A,54B,94C,112C 'ticket-vis':8A 'uncheck':125C 'user':108C 'userscontrol':103C 'version':168C 'visibl':10A 'without':113C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FreeScout installations below 1.8.231 where some agents are restricted to only their assigned tickets. Any non-admin agent with a profile form can exploit it against conversations in mailboxes they already belong to. Installations without restricted agents, or that are already on 1.8.231 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freescout","helpdesk","high","other","selfhosted"],"campaign_type":null,"search_a":"'-103985':14A,17A '-2026':13A,16A 'agent':3A 'cve':12A,15A 'freescout':1A 'lift':5A 'limit':11A 'restrict':2A 'ticket':9A 'ticket-vis':8A 'visibl':10A","search_b":"'admin':38B 'administr':44B 'administrator-set':43B 'agent':39B,58B,67B 'alreadi':71B 'assign':53B,64B 'belong':72B 'chang':62B 'convers':63B 'desk':21B,33B 'freescout':18B,26B 'help':20B,32B 'help-desk':19B 'host':25B,31B 'limit':48B 'mailbox':69B 'non':37B 'non-admin':36B 'read':60B 'remov':41B,56B 'restrict':46B 'self':24B,30B 'self-host':23B,29B 'set':45B 'ticket':54B","search_c":"'1.8.231':86C,169C 'add':105C 'admin':100C 'administr':120C,141C 'administrator-impos':140C 'agent':123C,145C,155C 'alreadi':160C 'assign':93C,111C,152C 'belong':161C 'check':114C 'convers':151C 'desk':80C 'editor':117C 'everi':157C 'expos':90C 'fix':166C 'form':89C 'freescout':73C 'help':79C 'host':78C 'impos':142C 'issu':164C 'mailbox':83C,158C 'modifi':150C 'non':99C 'non-admin':98C 'omit':135C 'option':127C 'ordinari':131C 'owner':101C 'perm':109C 'permiss':95C 'prior':84C 'profil':88C,132C 'profilesav':104C 'read':148C 'remov':107C,138C 'restrict':122C,143C 'save':133C 'self':77C 'self-host':76C 'share':82C 'submit':129C 'ticket':94C,112C 'uncheck':125C 'user':108C 'userscontrol':103C 'version':168C 'without':113C","first_public_at":"2026-08-14T13:35:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103985","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103985","severity":null,"published_at":"2026-11-06T17:17:10+00:00","modified_at":"2026-11-06T17:17:10+00:00","first_seen_at":"2026-11-06T17:43:11+00:00","fetched_at":"2026-11-06T17:43:11+00:00","note":null}],"documents":[{"id":88370,"url":"https://github.com/freescout-help-desk/freescout/commit/83030464eec3c03712ad988b81f069b372c45399","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88368,"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88372,"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-14T13:35:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}