CyberRota Analysis
AI-GeneratedFreeScout versions prior to 1.8.223 are vulnerable to unauthenticated message injection, allowing attackers to manipulate support conversations by sending a specially crafted email to the helpdesk's public address. This vulnerability can lead to unauthorized access to sensitive information and disruption of support workflows, as the injected messages appear legitimate to agents. Organizations using FreeScout should prioritize updating to version 1.8.223 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted `In-Reply-To` header. No credentials, tokens, or prior access are required. The injected message is rendered in the agent UI as a legitimate customer reply, the conversation is automatically reopened, and the `last_reply_from` field is set to the attacker's identity. Version 1.8.223 contains a fix.