CVE-2026-47123highCWE-290CWE-345

CVE-2026-47123: fallo de gravedad alta en freescout-help-desk freescout

FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear freescout

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 7.5epss 0.1%
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two code paths for identifying agent (user) replies based on In-Reply-To / References headers. The notification reply path (notify-{thread_id}-{user_id}-...) extracts thread_id and user_id directly from the Message-ID without HMAC verification. An external attacker who can spoof the From address of a helpdesk agent can inject messages that FreeScout processes as legitimate agent replies — which are then automatically forwarded to customers via the legitimate SMTP server. This vulnerability is fixed in 1.8.220.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Productos afectados
freescout-help-desk · freescout
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — freescout-help-desk freescout

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-28289CRITICALFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code ExecutionEPSS 35.1%CVE-2026-27636HIGHFreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on ApacheEPSS 2.2%CVE-2026-53595CRITICALFreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQLEPSS 1.9%CVE-2025-48471HIGHFreeScout Vulnerable to Arbitrary File UploadEPSS 1.2%CVE-2025-54366HIGHFreeScout's deserialization of untrusted data leads to Remote Code ExecutionEPSS 1.1%CVE-2025-48389HIGHFreeScout Vulnerable to Deserialization of Untrusted DataEPSS 1.0%