CVE-2026-40569: FreeScout Mass Assignment in Mailbox Connection Settings
FreeScout versions before 1.8.213 let an authenticated administrator overwrite protected mailbox fields through the connection settings save handlers, a mass assignment flaw classified as improper access control. The record rates it Critical with a CVSS 3.1 base score of 9.0 and states that version 1.8.213 fixes it. No confirmed exploitation appears in the sources consulted.
Overview
FreeScout versions before 1.8.213 contain a mass assignment flaw, mapped to CWE-284 (Improper Access Control), in the mailbox connection settings save handlers. According to the record, these handlers pass all submitted request fields to the mailbox model without an allowlist, so an authenticated administrator can change fields that are outside the connection settings form. The maintainers describe the fix in GHSA-hmqm-33wp-858j.
Impact
The record describes outcomes such as hidden changes to copy recipients, outgoing mail server settings, email signatures and auto-replies for a mailbox. Such changes may not be visible to other administrators who review only the connection settings page. The record gives a CVSS 3.1 base score of 9.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L, which indicates high confidentiality and integrity impact, a scope change, and a requirement for high privileges.
Affected products and versions
- Product: FreeScout, a self-hosted help desk and shared mailbox application.
- Affected: versions prior to 1.8.213, as stated in the record description.
- Fixed: version 1.8.213, per the record description and the release tag.
- The structured affected and fixes fields in the record are empty, so the version range comes from the description text.
Exploitation status
This CVE is not listed in the CISA KEV catalog according to the record, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade FreeScout to version 1.8.213 or later. The commit is referenced in the record.
- Until the upgrade is applied, limit administrator accounts to those who need them and review who can edit mailbox settings.
- Review each mailbox's general and connection settings for unexpected recipients, outgoing server addresses, signatures and auto-reply configurations.
- Treat administrator session security as part of the risk, since the record notes that a separate session compromise could extend the impact.
Detection guidance
- Compare current mailbox configurations against known-good values, with particular attention to copy recipients, outgoing mail server, signatures and auto-reply fields.
- Review application logs and administrative change history, where available in your deployment, for saves of mailbox settings by unexpected accounts.
- Monitor outgoing mail for unexpected copies sent to external addresses.
Limitations of the available information
The record has no structured affected or fixed version data, no title, and no KEV details. The sources do not describe how FreeScout logs these changes. The EPSS probability in the record is 0.00518 with a percentile of 0.42475; this is a predictive score and does not confirm exploitation. The title used here is derived from the description.
Frequently asked questions
Which FreeScout versions are affected?
According to the record description, versions prior to 1.8.213 are affected. The structured affected-version field in the record is empty.
Is this vulnerability being actively exploited?
The record does not list this CVE in the CISA KEV catalog, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted.
What should administrators do?
Upgrade FreeScout to version 1.8.213 or later, limit administrator accounts to those who need them, and review mailbox configurations for unexpected values.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.