CVE-2026-32752 in freescout
Summary
by MITRE • 03/20/2026
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages (evidence tampering), bypasses the entire mailbox permission model, and constitutes a GDPR/compliance violation. The issue has been fixed in version 1.8.209.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/25/2026
The vulnerability described in CVE-2026-32752 represents a critical access control flaw within the FreeScout help desk system that fundamentally undermines the application's security model. This issue affects versions 1.8.208 and earlier, where the ThreadPolicy::edit() method fails to properly validate user permissions when accessing thread messages. The flaw exists within the Laravel framework-based application that serves as a shared inbox solution, making it particularly concerning given the sensitive nature of customer communications and support ticket data. The vulnerability impacts the core authorization mechanism that should prevent unauthorized access to customer messages across different mailboxes, creating a severe breach in the system's security architecture.
The technical implementation of this vulnerability stems from improper access control validation within the ThreadPolicy::edit() method, which should enforce role-based permissions and mailbox-specific access controls. This broken access control vulnerability allows any authenticated user to bypass the normal permission checks that would typically restrict access to messages based on mailbox ownership, user roles, or assigned permissions. The flaw operates at the policy level where access decisions are made, meaning that even users without proper authorization can perform read and write operations on customer messages regardless of which mailbox they belong to. This represents a direct violation of the principle of least privilege and undermines the application's ability to maintain data segregation and confidentiality.
The operational impact of this vulnerability extends far beyond simple unauthorized access, creating significant risks for compliance and data integrity. Attackers can silently modify customer messages, enabling evidence tampering that could be used to cover up malicious activities or alter the record of customer interactions. This capability constitutes a serious GDPR violation as it allows unauthorized modification of personal data without proper consent or audit trails. The vulnerability effectively nullifies the entire mailbox permission model that FreeScout implements, meaning that users with minimal privileges can access and modify sensitive customer communications across all mailboxes. Such a flaw would be particularly damaging in regulated environments where auditability and data integrity are mandatory requirements.
Organizations using FreeScout versions 1.8.208 and earlier face substantial risk of data breaches, compliance violations, and potential legal consequences due to unauthorized modification of customer communications. The vulnerability creates opportunities for insider threats or compromised accounts to cause significant damage to customer relationships and organizational reputation. System administrators should immediately implement the remediation by upgrading to version 1.8.209, which addresses the access control flaw in the ThreadPolicy::edit() method. Additional mitigations may include implementing network-level restrictions, monitoring for unauthorized access attempts, and conducting thorough audits of customer message modifications. This vulnerability aligns with CWE-284 (Improper Access Control) and could be categorized under ATT&CK technique T1566 (Phishing) or T1567 (Adversary-in-the-Middle) when exploited by threat actors, depending on the specific attack vector used to gain initial access to the system.