{"id":"CVE-2026-41183","aliases":["EUVD-2026-24191","GHSA-7rh8-9rgv-g35r"],"status":"published","title":"FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations","description":"FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00224,"percentile":0.13118,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-04-21T17:00:39Z","modified":"2026-10-28T02:30:46Z","products":[{"vendor":"freescout-help-desk","product":"freescout"}],"references":[{"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-7rh8-9rgv-g35r","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/freescout-help-desk/freescout/commit/6583d6f5a593b51223904f9e0f2e721e63c76de0","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.215","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41183.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41183","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41183","title":"FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations","description":"FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.","status":"published","published":"2026-04-21T17:00:39.033Z","modified":"2026-04-21T20:37:11.192Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-24191","description":"FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.","status":"published","published":"2026-04-21T17:00:39Z","modified":"2026-04-21T20:37:11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:21.101387Z"}],"nvd":[{"id":"CVE-2026-41183","description":"FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.","status":"published","published":"2026-04-21T17:16:57.227Z","modified":"2026-06-17T10:46:17.517Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:15.493943Z"}],"osv":[{"id":"CVE-2026-41183","title":"FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations","description":"FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.","status":"published","published":"2026-04-21T17:00:39.033Z","modified":"2026-10-28T02:30:46.040875326Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:03.424067Z"}]}}