Description

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_assigned_tickets permission to its non-admin owner, and UsersController::profileSave() adds or removes User::PERM_ONLY_ASSIGNED_TICKETS without checking that the editor is an administrator. A restricted agent can uncheck the option, or submit an ordinary profile save that omits it, to remove the administrator-imposed restriction. The agent can then read and modify conversations assigned to other agents in every mailbox they already belong to. This issue is fixed in version 1.8.231.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-06T17:17:10.887Z",
  "pubdate": "2026-11-06T17:17:10.887Z",
  "executiveSummary": "FreeScout versions prior to 1.8.231 contain an authorization bypass vulnerability within the profile management system.\nThe vulnerability is classified as an improper access control issue, allowing authenticated non-administrator users to modify their own permission sets.\nSpecifically, restricted agents can manipulate the 'only_assigned_tickets' permission flag, which is intended to be controlled exclusively by administrators to limit visibility.\nBy successfully unsetting this restriction, a restricted agent gains unauthorized access to conversations assigned to other agents within shared mailboxes they are authorized to access.\nThe impact includes unauthorized disclosure of sensitive customer communications and potential data integrity risks, as the attacker gains broader read and write capabilities than intended by organizational policy.\nExploitation requires the attacker to possess an active agent account on the platform; no external network access or administrative credentials are required to initiate the attack flow.",
  "technicalDetails": "The vulnerability resides in the UsersController::profileSave() function, which handles the persistence of user profile settings. The root cause is a failure to perform server-side authorization checks when processing requests that modify user permissions.\nIn FreeScout, the 'only_assigned_tickets' permission acts as a restrictive toggle meant to limit an agent's view to only those tickets specifically assigned to them. Under normal operational conditions, this configuration is strictly managed by administrators to ensure data segregation among support personnel.\nThe input data reveals that the application's profile form inappropriately exposes this permission field to non-admin users. During the execution of UsersController::profileSave(), the application processes the POST request parameters to update the user record. Crucially, the controller logic lacks a condition to verify if the user initiating the request possesses administrative privileges before adding or removing the User::PERM_ONLY_ASSIGNED_TICKETS constant from the user's permission set.\nAn attacker can exploit this by intercepting the profile update request and modifying the payload to exclude the 'only_assigned_tickets' parameter or by explicitly setting it to a disabled state. Because the backend code blindly trusts the provided input in the profile save operation, it updates the database to reflect the downgraded permission state for the authenticated user.\nOnce the permission is stripped from their profile, the application's internal access control layer, which relies on the 'only_assigned_tickets' flag to filter mailbox queries, no longer applies restrictions to the agent. Consequently, the agent's session is upgraded to include view and edit access to all tickets within the mailboxes to which they are assigned, rather than just their own.\nThis represents a horizontal privilege escalation where the agent moves from a restricted scope to a broader scope of authority. The post-exploitation impact includes the ability to perform unauthorized actions on tickets managed by other personnel, leading to potential information leakage and breach of internal communication privacy protocols. The vulnerability persists in all instances running FreeScout versions older than 1.8.231."
}