CVE-2026-40592

What it is

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks only whether the current user can view the parent conversation. It does not verify that the current user created the reply being undone. In a shared mailbox, one agent can therefore recall another agent's just-sent reply during the 15-second undo window. Version 1.8.214 fixes the vulnerability.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data tampering.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-04-21 17:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 10:45 UTC Last updatedMost recent change to the record

Details

Published

2026-04-21 17:16 UTC

Last modified

2026-06-17 10:45 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-862 · Missing authorization

Record status

Deferred

Attack profile CVSS 3.1 · 5.9

Attack vector

Network

Complexity

High

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low