PT-2026-34027 · Freescout · Freescout
CVE-2026-40592
·
Published
2026-04-21
·
Updated
2026-04-27
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
FreeScout versions prior to 1.8.214
Description
The undo-send route "/conversation/undo-reply/{thread id}" only verifies if the current user has permission to view the parent conversation. It fails to confirm that the user attempting the action is the one who created the reply. In a shared mailbox environment, this allows one agent to recall a reply sent by another agent within the 15-second undo window.
Recommendations
Update to version 1.8.214.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freescout