CVE-2026-85744 · Package
NO FIX YET · SEE WHAT TO DO
FreeScout is a self-hosted help desk; a logged-in agent can merge a conversation they control into a conversation in a mailbox they lack access to. The merge injects threads and attachments into the target and deletes the source, but does not reveal the target's existing contents.
first public Aug 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a self-hosted FreeScout instance where agent accounts exist and mailboxes have restricted access. Exposure requires an authenticated agent account; hosted or single-user installs without multiple agents are less exposed. unknown for exact configuration conditions beyond this.
Not affected if managed-hosting, no-untrusted-agents, single-mailbox
Who cares freescout, help-desk, self-hosted
1.8.227.1.8.227 or later.FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target's existing contents. This issue is fixed in version 1.8.227.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.