CVE-2026-41194: falha de média gravidade em freescout-help-desk freescout
FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.1%
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the mailbox OAuth disconnect action is implemented as `GET /mailbox/oauth-disconnect/{id}/{in_out}/{provider}`. It removes stored OAuth metadata from the mailbox and then redirects. Because it is a GET route, no CSRF token is required and the action can be triggered cross-site against a logged-in mailbox admin. Version 1.8.215 fixes the vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Produtos afetados
freescout-help-desk · freescoutCVEs relacionadas — freescout-help-desk freescout
No mesmo produto, das mais perigosas para as menos.
CVE-2026-28289CRITICALFreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code ExecutionEPSS 35.1%CVE-2026-27636HIGHFreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on ApacheEPSS 2.2%CVE-2026-53595CRITICALFreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQLEPSS 1.9%CVE-2025-48471HIGHFreeScout Vulnerable to Arbitrary File UploadEPSS 1.2%CVE-2025-54366HIGHFreeScout's deserialization of untrusted data leads to Remote Code ExecutionEPSS 1.1%CVE-2025-48389HIGHFreeScout Vulnerable to Deserialization of Untrusted DataEPSS 1.0%