---
id: "CVE-2026-103985"
page: "https://infrastack.ai/live/CVE-2026-103985"
kind: "vulnerability"
aliases: ["CVE-2026-103985"]
title: "FreeScout: restricted agents can lift their own ticket-visibility limit"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["freescout", "help-desk", "other", "self-hosted"]
not_affected_if: ["fixed-version", "no-restricted-agents"]
published_at: "2026-11-06T17:17:10+00:00"
first_seen_at: "2026-11-06T17:43:11+00:00"
updated_at: "2026-11-06T17:45:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103985", "first_seen_at": "2026-11-06T17:43:11+00:00"}]
exploit_sources: []
---

# FreeScout: restricted agents can lift their own ticket-visibility limit

Link for people: https://infrastack.ai/live/CVE-2026-103985 (this .md is for agents)

FreeScout is a self-hosted help desk where a non-admin agent can remove the administrator-set restriction that limits them to their own assigned tickets. Once removed, the agent can read and change conversations assigned to other agents in mailboxes they already belong to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FreeScout version; the sources say versions before `1.8.231` are affected.
- Review which users have the 'only assigned tickets' restriction and whether non-admin agents can edit their own profile.

## Fix

- FreeScout: upgrade to `1.8.231`

## Timeline

- 2026-11-06T17:43:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103985

## Documents

- [advisory] Vendor advisory: github.com https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-m4hc-rc98-38jc
- [fix] Patch: github.com https://github.com/freescout-help-desk/freescout/commit/83030464eec3c03712ad988b81f069b372c45399
- [fix] Release notes: github.com https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231

## From the sources

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_