{"id":"CVE-2026-32752","aliases":["EUVD-2026-13219","GHSA-wxg5-g9vv-v8g9"],"status":"published","title":"FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages","description":"FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages (evidence tampering), bypasses the entire mailbox permission model, and constitutes a GDPR/compliance violation. The issue has been fixed in version 1.8.209.","severity":{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00294,"percentile":0.22291,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-03-19T21:21:54Z","modified":"2026-11-11T10:30:51Z","products":[{"vendor":"freescout","product":"freescout"},{"vendor":"freescout-help-desk","product":"freescout"}],"references":[{"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wxg5-g9vv-v8g9","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory"]},{"url":"https://github.com/freescout-help-desk/freescout/commit/996a7f96337fdd8a1d1bbd0da0ec7ec85d160b11","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.209","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32752.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32752","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-32752","title":"FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages","description":"FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages (evidence tampering), bypasses the entire mailbox permission model, and constitutes a GDPR/compliance violation. The issue has been fixed in version 1.8.209.","status":"published","published":"2026-03-19T21:21:54.613Z","modified":"2026-03-20T18:10:32.968Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-13219","description":"FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages (evidence tampering), bypasses the entire mailbox permission model, and constitutes a GDPR/compliance violation. The issue has been fixed in version 1.8.209.","status":"published","published":"2026-03-19T21:21:54Z","modified":"2026-03-20T18:10:32Z","updated_at":"2026-11-02T19:25:32.04432Z"}],"nvd":[{"id":"CVE-2026-32752","description":"FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages (evidence tampering), bypasses the entire mailbox permission model, and constitutes a GDPR/compliance violation. The issue has been fixed in version 1.8.209.","status":"published","published":"2026-03-19T22:16:41.65Z","modified":"2026-06-17T10:36:19.48Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"CVE-2026-32752","title":"FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages","description":"FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages (evidence tampering), bypasses the entire mailbox permission model, and constitutes a GDPR/compliance violation. The issue has been fixed in version 1.8.209.","status":"published","published":"2026-03-19T21:21:54.613Z","modified":"2026-11-11T10:30:51.387789884Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-284"],"updated_at":"2026-11-11T11:06:44.026152Z"}]}}