Description Summary:
The FreeScout help desk software contains an unrestricted file upload vulnerability that allows authenticated users to execute arbitrary files on the server.

Executive Summary:
An unrestricted file upload vulnerability in FreeScout allows authenticated attackers to potentially achieve remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2026-53593

Affected Software: freescout-help-desk freescout

Affected Versions: < 1.8.224

Vulnerability: The application is susceptible to an unrestricted file upload of dangerous types (CWE-434). This flaw allows an authenticated user to upload malicious files, which could lead to arbitrary code execution if the server processes the uploaded file.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to compromise the server integrity and gain full control over the help desk environment. Given the CVSS score of 8.8, the potential for unauthorized access and total system compromise makes this a high priority for security teams.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.224 or later to address the file upload validation flaw.

Proactive Monitoring: Review file upload logs and scan the application server directories for suspicious files or executable scripts located in upload paths.

Compensating Controls: Implement strict file type validation at the WAF level and restrict write permissions for the web server user on upload directories.

Exploitation Status

Public Exploit Available: No confirmed public exploit in the available data.

Analyst Notes: As of July 21, 2026, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. While the risk is high, the requirement for authentication limits the immediate attack surface to existing users.

Analyst Recommendation

Organizations should update their FreeScout installation to the latest version as soon as possible. Restricting user permissions and ensuring that only authorized individuals have access to file upload features will further reduce the risk of exploitation.

Description Summary:
FreeScout help desk software is affected by an improper authentication vulnerability, allowing unauthenticated attackers to bypass security controls.

Executive Summary:
An improper authentication flaw in FreeScout allows unauthenticated attackers to bypass security controls and potentially access sensitive help desk data.

Vulnerability Details

CVE-ID: CVE-2026-53591

Affected Software: freescout-help-desk freescout

Affected Versions: < 1.8.223

Vulnerability: This is an authentication bypass vulnerability (CWE-287) that allows an unauthenticated attacker to perform actions within the application without valid credentials. The vulnerability resides in the authentication logic, failing to verify the identity of the requester properly.

Business Impact

This vulnerability grants unauthenticated users access to the help desk, which often contains sensitive customer communications and internal business data. With a CVSS score of 8.6, the risk of data breach and unauthorized modification of help desk records is significant.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.223 or later to correct the authentication mechanism.

Proactive Monitoring: Audit access logs for unauthorized administrative actions or unusual patterns of activity that do not correlate with known user sessions.

Compensating Controls: Utilize IP whitelisting or VPN-based access controls to restrict exposure of the help desk portal to trusted networks only.

Exploitation Status

Public Exploit Available: No confirmed public exploit in the available data.

Analyst Notes: As of July 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The ability for an unauthenticated user to bypass security makes this a high-priority issue.

Analyst Recommendation

The vulnerability poses a severe risk to data confidentiality and integrity. Administrators must apply the provided patch immediately to ensure that access controls are correctly enforced and to prevent unauthorized system access.

Description Summary:
FreeScout prior to version 1.8.217 contains a Server-Side Request Forgery vulnerability in the Helper::sanitizeRemoteUrl() function.

Executive Summary:
A Server-Side Request Forgery vulnerability in FreeScout allows low-privileged authenticated attackers to access internal network services and cloud metadata endpoints.

Vulnerability Details

CVE-ID: CVE-2026-41905

Affected Software: FreeScout FreeScout

Affected Versions: < 1.8.217

Vulnerability: This is a Server-Side Request Forgery (CWE-918) flaw residing in the Helper::sanitizeRemoteUrl() function within app/Misc/Helper.php, requiring low privileges and network access to exploit.

Business Impact

A successful exploit allows attackers to pivot into the internal network, potentially exposing sensitive internal APIs, cloud metadata services, and RFC1918 address spaces. This creates significant risks of data exfiltration and internal service compromise. The CVSS score of 7.7 justifies a high severity rating due to the high confidentiality impact and network attack vector.

Remediation Plan

Immediate Action: Update FreeScout to version 1.8.217 or later to resolve the SSRF vulnerability.

Proactive Monitoring: Monitor network traffic from the FreeScout application server for unauthorized or anomalous requests targeting internal IP ranges and cloud metadata endpoints.

Compensating Controls: Implement strict egress filtering and firewall rules on the application server to block outbound access to private IP address ranges and cloud metadata services.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from improper validation of HTTP redirects during URL sanitization.

Analyst Recommendation

This vulnerability presents a clear pathway for internal network reconnaissance and service abuse via request forgery. Security teams must apply the primary remediation by updating to version 1.8.217 immediately to eliminate the risk of internal exposure.

Description Summary:
A stored cross-site scripting vulnerability in FreeScout prior to version 1.8.217 allows authenticated users with updateAutoReply permissions to inject malicious payloads into auto-reply messages.

Executive Summary:
A stored cross-site scripting vulnerability in FreeScout affects versions prior to 1.8.217, creating significant risks of client-side code execution for customers receiving automated emails.

Vulnerability Details

CVE-ID: CVE-2026-41904

Affected Software: FreeScout FreeScout Help Desk

Affected Versions: < 1.8.217

Vulnerability: This is a stored cross-site scripting flaw classified under CWE-79, triggered when an authenticated user with updateAutoReply permissions stores a malicious payload that executes in the context of the customer's webmail client.

Business Impact

A successful exploit allows attackers to execute arbitrary scripts within the email clients of customers who contact the help desk. This can lead to unauthorized actions, session hijacking, or data exfiltration via the victim mail client. The CVSS score of 7.6 reflects a high severity level due to the potential for confidentiality and integrity impacts against external users.

Remediation Plan

Immediate Action: Update FreeScout to version 1.8.217 or later where this vulnerability has been patched.

Proactive Monitoring: Review administrative audit logs for suspicious modifications to auto-reply messages or unusual privilege assignments.

Compensating Controls: Enforce strict access controls to limit the updateAutoReply permission exclusively to trusted administrative accounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Organizations utilizing FreeScout should prioritize upgrading to version 1.8.217 immediately to eliminate the underlying cross-site scripting flaw. Reviewing user permissions to ensure strict adherence to the principle of least privilege will further reduce the likelihood of unauthorized payload injection.

Description Summary:
FreeScout contains a flaw in the user-setup endpoint where invite hashes do not expire, allowing unauthenticated attackers to perform permanent account takeovers.

Executive Summary:
A critical vulnerability in FreeScout enables unauthenticated account takeover due to improper expiration controls on user invitation hashes.

Vulnerability Details

CVE-ID: CVE-2026-41902

Affected Software: FreeScout

Affected Versions: Prior to 1.8.217

Vulnerability: The /user-setup/{hash} endpoint fails to invalidate invite hashes, allowing them to remain valid indefinitely. An unauthenticated attacker can exploit this via leaked hashes to gain unauthorized access, including administrative privileges if the target account is an admin.

Business Impact

This vulnerability carries a 9.1 CVSS score, reflecting the ease of account takeover and the potential for full administrative compromise. Successful exploitation could lead to unauthorized access to sensitive help desk data, customer communications, and internal workflows, resulting in significant reputational and data privacy risks.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.217 or later immediately to enforce proper hash expiration and lifecycle management.

Proactive Monitoring: Audit existing user accounts for suspicious activity and review access logs for unexpected logins originating from the user-setup endpoint.

Compensating Controls: Ensure that invitation emails are not forwarded or stored in insecure locations and implement multi-factor authentication (MFA) to prevent unauthorized account access.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The risk of permanent account takeover is severe. Administrators must prioritize updating to version 1.8.217 to ensure that invitation hashes are properly invalidated and to secure the administrative interface against unauthorized access.

Description Summary:
FreeScout before 1.8.215 contains an arbitrary file write vulnerability in the module installation feature due to improper validation of ZIP archive file paths.

Executive Summary:
An authenticated administrative vulnerability in FreeScout allows arbitrary file writes on the server, posing a critical risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-41193

Affected Software: FreeScout

Affected Versions: Prior to 1.8.215

Vulnerability: The vulnerability exists in the module installation feature, which fails to validate file paths when extracting ZIP archives. An authenticated administrator can leverage this to write malicious files to arbitrary locations on the server filesystem.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a severe threat to the underlying server infrastructure. An attacker with administrative access could achieve remote code execution, leading to full server compromise, persistent backdoors, and total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.215 or later to resolve the archive extraction flaw.

Proactive Monitoring: Inspect the server's web directories and sensitive system paths for the presence of unauthorized or unexpected files created during module installation tasks.

Compensating Controls: Restrict administrative access to the module installation interface to trusted personnel only and ensure the web server service account has minimal filesystem write permissions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a significant security risk for self-hosted FreeScout instances. Administrators must prioritize the update to version 1.8.215 to prevent potential remote code execution via arbitrary file writes.

Description Summary:
A low-privileged agent in FreeScout can perform an authorization bypass to reassign customer email addresses and conversations from hidden mailboxes to visible ones.

Executive Summary:
An authorization bypass vulnerability in FreeScout allows authenticated agents to gain unauthorized access to data in hidden mailboxes, posing a significant risk to customer privacy and data integrity.

Vulnerability Details

CVE-ID: CVE-2026-40589

Affected Software: FreeScout Help Desk

Affected Versions: < 1.8.214

Vulnerability: This flaw, categorized as CWE-639, allows a low-privileged authenticated agent to manipulate customer profiles and reassign email addresses. By triggering this authorization bypass, the attacker can force the application to rebind conversations from hidden mailboxes to visible customer profiles, resulting in the unauthorized disclosure of sensitive customer information.

Business Impact

Successful exploitation of this vulnerability compromises the confidentiality and integrity of help desk operations. By accessing hidden customer profiles and conversations, an attacker can exfiltrate private data and disrupt communication workflows, leading to potential regulatory compliance violations and loss of customer trust. With a CVSS score of 7.6, this is a High severity issue that requires immediate attention to prevent unauthorized data exposure.

Remediation Plan

Immediate Action: Update the FreeScout installation to version 1.8.214 or later to apply the necessary authorization checks.

Proactive Monitoring: Review audit logs for unusual agent activity, specifically looking for unexpected reassignments of customer email addresses or sudden access to hidden mailbox data.

Compensating Controls: Restrict permissions for agent accounts to the minimum level required for their role and implement strict access controls on sensitive mailbox configurations.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of April 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability relies on the application failing to validate ownership of customer email addresses during the update process.

Analyst Recommendation

The ability for an agent to bridge the gap between hidden and visible mailboxes represents a critical failure in data isolation. Administrators must prioritize updating to version 1.8.214 immediately to close this authorization gap and protect sensitive customer communications from unauthorized internal access.

Description Summary:
FreeScout versions prior to 1.8.213 contain a mass assignment vulnerability in mailbox connection settings, allowing authenticated admins to overwrite sensitive configuration fields.

Executive Summary:
A mass assignment vulnerability in FreeScout allows an authenticated administrator to perform unauthorized mailbox modifications, leading to persistent email exfiltration and account compromise.

Vulnerability Details

CVE-ID: CVE-2026-40569

Affected Software: FreeScout

Affected Versions: Prior to 1.8.213

Vulnerability: The application fails to implement field allowlisting in connectionIncomingSave() and connectionOutgoingSave() methods, enabling an authenticated admin user to inject unauthorized parameters into the Mailbox model.

Business Impact

Successful exploitation allows an attacker to silently enable BCC forwarding, redirect SMTP traffic, or inject phishing content into email signatures. Given the CVSS score of 9.0, this vulnerability poses a severe risk of data exfiltration and loss of communication integrity, potentially leading to regulatory non-compliance and significant reputational damage.

Remediation Plan

Immediate Action: Upgrade the FreeScout installation to version 1.8.213 or later immediately to enforce proper parameter validation.

Proactive Monitoring: Review application logs for unusual administrative activity and monitor outbound mail server configurations for unexpected BCC addresses or SMTP relay changes.

Compensating Controls: Implement strict administrative access controls and utilize a Web Application Firewall (WAF) to inspect POST requests for unexpected parameters in the mailbox settings endpoints.

Exploitation Status

Public Exploit Available: Not specified.

Analyst Notes: As of Apr 21, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a critical security oversight in the application's configuration management. Administrators should prioritize updating to version 1.8.213 immediately to close the mass assignment vector, as the silent nature of the injection makes detection difficult without proactive audit logging.

Description Summary:
FreeScout versions prior to 1.8.213 contain a stored cross-site scripting (XSS) vulnerability in the mailbox signature feature due to insufficient input sanitization.

Executive Summary:
A stored cross-site scripting vulnerability in FreeScout allows authenticated users with specific mailbox permissions to inject malicious scripts, potentially leading to unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-40568

Affected Software: FreeScout Help Desk

Affected Versions: < 1.8.213

Vulnerability: The application utilizes an incomplete blocklist in the Helper::stripDangerousTags() function, which fails to neutralize event handler attributes such as onerror and onload. Any authenticated user possessing the ACCESS_PERM_SIGNATURE permission can inject arbitrary JavaScript that executes automatically upon rendering within the application interface.

Business Impact

The exploitation of this vulnerability allows an attacker to execute arbitrary code within the context of other users, including administrators. This can lead to session hijacking, unauthorized data access, or the performance of actions on behalf of the victim, effectively compromising the integrity of the help desk platform. With a CVSS score of 8.5, this flaw represents a high-severity risk that could facilitate lateral movement within the organization.

Remediation Plan

Immediate Action: Update the FreeScout installation to version 1.8.213 or later to apply the necessary sanitization logic.

Proactive Monitoring: Review application logs for unusual activity related to mailbox signature updates or unexpected modifications to user profiles and settings.

Compensating Controls: Implement a Web Application Firewall with rules configured to detect and block suspicious HTML event handlers in user-supplied input fields.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the application explicitly renders user-controlled input as raw HTML without adequate filtering of dangerous event handlers.

Analyst Recommendation

Given the potential for script execution with the privileges of other users, including those with elevated access, organizations should prioritize patching this vulnerability. Apply the update to version 1.8.213 immediately to ensure that input sanitization is correctly enforced and to prevent the unauthorized execution of malicious scripts within your help desk environment.

Description Summary:
A stored cross-site scripting vulnerability in FreeScout allows authenticated agents to exfiltrate CSRF tokens via malicious CSS, potentially leading to unauthorized privilege escalation.

Executive Summary:
An authenticated cross-site scripting vulnerability in FreeScout versions prior to 1.8.213 permits attackers to steal administrative CSRF tokens and perform unauthorized administrative actions.

Vulnerability Details

CVE-ID: CVE-2026-40497

Affected Software: FreeScout Help Desk

Affected Versions: < 1.8.213

Vulnerability: The application fails to adequately sanitize <style> tags within the mailbox signature field, allowing authenticated users with mailbox access to inject CSS. This flaw enables the exfiltration of CSRF tokens from administrators or other agents who view the affected conversation, facilitating account takeover or unauthorized state changes.

Business Impact

The exploitation of this vulnerability poses a significant risk to organizational integrity by allowing an attacker to escalate privileges from an agent to an administrator. Successful execution leads to full control over the help desk environment, including the ability to modify security settings, reset passwords, or access sensitive customer communications. With a CVSS score of 8.1, this issue represents a high-severity threat to confidentiality and integrity.

Remediation Plan

Immediate Action: Update the FreeScout installation to version 1.8.213 or later to apply the necessary sanitization logic for style tags.

Proactive Monitoring: Review audit logs for suspicious administrative actions, such as unexpected account creations or modifications to sensitive system configurations, originating from internal user accounts.

Compensating Controls: Implement a strict Content Security Policy (CSP) that restricts the execution of inline styles and unauthorized scripts, and ensure that Web Application Firewalls are configured to inspect and block suspicious CSS injection patterns in POST requests.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it relies on the browser interpreting malicious CSS, which is a common but often overlooked vector for administrative credential theft.

Analyst Recommendation

Given the potential for complete administrative account takeover, organizations using FreeScout must prioritize this update. Administrators should verify their current version immediately and apply the patch to mitigate the risk of privilege escalation. Failure to address this flaw leaves the help desk infrastructure vulnerable to internal compromise by malicious or compromised user accounts.

Description Summary:
FreeScout contains an authorization bypass vulnerability in the customer merging process, allowing authenticated users to manipulate data due to an ignored security parameter.

Executive Summary:
FreeScout versions prior to 1.8.212 are vulnerable to an authorization bypass that could allow authenticated users to improperly merge customer data.

Vulnerability Details

CVE-ID: CVE-2026-39384

Affected Software: FreeScout Help Desk

Affected Versions: < 1.8.212

Vulnerability: This is an authorization bypass flaw (CWE-639) where the application fails to validate the limit_user_customer_visibility parameter during customer merge operations, requiring low-privileged authenticated access to exploit.

Business Impact

Successful exploitation of this flaw allows an authenticated user to bypass intended authorization controls, potentially leading to unauthorized data modification or exposure of sensitive customer information. With a CVSS score of 7.6, this vulnerability represents a high risk to data integrity within the help desk environment, which may result in significant operational disruption or compliance concerns.

Remediation Plan

Immediate Action: Update the FreeScout installation to version 1.8.212 or later to apply the necessary security patch.

Proactive Monitoring: Review audit logs for suspicious customer merge activity or unauthorized account modifications.

Compensating Controls: Implement strict access control lists and review user permissions within the help desk to ensure that only authorized personnel can perform sensitive administrative tasks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from a failure to enforce visibility limits, which is a common oversight in complex multi-tenant applications.

Analyst Recommendation

Given the potential for unauthorized data manipulation and the existence of a proof-of-concept, administrators should prioritize updating FreeScout to version 1.8.212. Applying this patch is the most effective way to remediate the authorization flaw and prevent potential data integrity compromises.

Description Summary:
FreeScout versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) via unsanitized email notification templates, allowing unauthenticated attackers to execute arbitrary scripts.

Executive Summary:
A critical Stored XSS vulnerability in FreeScout allows unauthenticated attackers to conduct session hijacking and account takeover by injecting malicious payloads into email notifications.

Vulnerability Details

CVE-ID: CVE-2026-32754

Affected Software: FreeScout

Affected Versions: 1.8.208 and below

Vulnerability: This is a Stored Cross-Site Scripting (XSS) vulnerability originating from the improper sanitization of incoming email bodies within the Laravel framework. An unauthenticated attacker can inject malicious HTML or JavaScript that executes when viewed by an agent or administrator, leading to credential theft or account takeover.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational security, as it allows attackers to compromise administrative accounts and gain unauthorized access to sensitive help desk communications. Given the CVSS score of 9.3, this flaw represents a critical threat to data confidentiality and integrity, potentially leading to widespread account compromise and reputational damage.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.209 or later immediately to apply the necessary output sanitization.

Proactive Monitoring: Monitor help desk email traffic for unusual patterns and review system logs for suspicious activity originating from external email addresses.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a WAF to filter common XSS payloads in incoming emails.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease of exploitation, the potential for malicious activity is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating the FreeScout application to version 1.8.209 to mitigate the risk of remote code execution and unauthorized account access.

Description Summary:
A TOCTOU flaw in FreeScout's file upload sanitization allows authenticated users to achieve RCE by uploading malicious .htaccess files using zero-width space prefixes.

Executive Summary:
FreeScout is vulnerable to a critical remote code execution flaw where authenticated users can bypass security filters to upload malicious configuration files and take control of the server.

Vulnerability Details

CVE-ID: CVE-2026-28289

Affected Software: FreeScout

Affected Versions: 1.8.206 and earlier

Vulnerability: A Time-of-Check to Time-of-Use (TOCTOU) flaw exists in the sanitizeUploadedFileName() function. An authenticated user with upload permissions can bypass the dot-prefix check by using a zero-width space, allowing the upload of a malicious .htaccess file that leads to RCE.

Business Impact

This vulnerability has a CVSS score of 10, the highest possible severity. It allows any user with basic file upload permissions to escalate their privileges to full server control. This could result in the theft of all help desk data, customer communications, and total infrastructure compromise.

Remediation Plan

Immediate Action: Update FreeScout to version 1.8.207 immediately to patch the sanitization logic and prevent the upload of configuration files.

Proactive Monitoring: Inspect the web root and upload directories for hidden files, specifically .htaccess files or files containing zero-width space characters (U+200B).

Compensating Controls: Disable the execution of scripts in upload directories via web server configuration and implement strict file extension whitelisting at the web server level.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 3, 2026, there is no public information indicating active exploitation. This is a patch bypass for a previous CVE, indicating that attackers are likely already looking for ways to circumvent these specific checks.

Analyst Recommendation

The CVSS 10 rating necessitates immediate action. Organizations using FreeScout must prioritize this update to prevent internal or compromised accounts from achieving full remote code execution.

Description Summary:
A critical authentication bypass in FreeScout allows attackers to compute valid session tokens and take over any user account, including administrators, if the application key is exposed.

Executive Summary:
Predictable authentication tokens in FreeScout allow attackers to perform full account takeovers, potentially compromising all help desk communications and administrative controls.

Vulnerability Details

CVE-ID: CVE-2026-27637

Affected Software: FreeScout

Affected Versions: Versions prior to 1.8.206

Vulnerability: The TokenAuth middleware uses a predictable MD5 hash of the user ID, creation timestamp, and the APP_KEY. If an attacker obtains the APP_KEY, they can generate valid, non-expiring tokens for any user account without needing a password.

Business Impact

Full account takeover of an administrator allows an attacker to read all private communications, delete data, and modify system settings. The CVSS score of 9.8 indicates a critical risk, especially given how frequently Laravel APP_KEY values are accidentally exposed in logs or environment files.

Remediation Plan

Immediate Action: Upgrade FreeScout to version 1.8.206. After upgrading, it is highly recommended to rotate the Laravel APP_KEY to invalidate any potentially compromised tokens.

Proactive Monitoring: Inspect logs for suspicious logins using API tokens and verify the security of the .env file and other configuration backups.

Compensating Controls: Ensure that environment files are not accessible via the web and implement multi-factor authentication (MFA) where supported to provide an additional layer of security.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of February 25, 2026, there is no evidence of active exploitation. This vulnerability is often paired with CVE-2026-27636, making the update to 1.8.206 essential.

Analyst Recommendation

The reliance on a predictable hash for authentication is a severe architectural flaw. Organizations must update FreeScout immediately and treat their APP_KEY as a high-value secret that requires immediate rotation if exposure is suspected.

Description Summary:
FreeScout versions prior to 1.8.206 allow authenticated users to upload malicious .htaccess files, leading to remote code execution on misconfigured Apache servers.

Executive Summary:
An authenticated remote code execution vulnerability in FreeScout allows attackers to compromise the underlying server through unrestricted file uploads.

Vulnerability Details

CVE-ID: CVE-2026-27636

Affected Software: FreeScout Help Desk

Affected Versions: < 1.8.206

Vulnerability: This vulnerability is an unrestricted file upload flaw (CWE-434) located in the file restriction logic of the application. An authenticated user can upload a .htaccess file that, when hosted on an Apache server with AllowOverride All, permits the execution of arbitrary code.

Business Impact

The ability to achieve remote code execution poses a critical risk to the confidentiality, integrity, and availability of the entire help desk environment. With a CVSS score of 8.8, this flaw could allow an attacker to gain full control over the web server, potentially leading to unauthorized access to sensitive customer support data and internal system credentials.

Remediation Plan

Immediate Action: Update the FreeScout application to version 1.8.206 or later immediately to implement the necessary file restriction patches.

Proactive Monitoring: Review web server access logs for unusual file upload activity or requests targeting the configuration files and implement integrity monitoring for the web directory.

Compensating Controls: Ensure that Apache server configurations are hardened by disabling AllowOverride if not strictly required, and utilize a Web Application Firewall (WAF) to filter and block files with prohibited extensions such as .htaccess or .user.ini.

Exploitation Status

Public Exploit Available: Yes, a Metasploit module is available.

Analyst Notes: As of February 26, 2026, there is no confirmed active exploitation in the wild; however, the availability of a functional Metasploit module makes this vulnerability a high-priority target for automated exploitation. The flaw is inherently dangerous due to the ease with which configuration files can be manipulated to redirect execution flow.

Analyst Recommendation

The severity of this vulnerability, combined with the presence of a public Metasploit exploit, necessitates immediate action. Administrators must prioritize updating to version 1.8.206 to close the upload vector. Failure to remediate this issue quickly exposes the host system to full compromise by any authenticated user.