CVE Tools
Sign in

CVE-2026-32752

FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages

Published: Mar 19, 2026Updated: Mar 23, 2026 Sources: CVE List NVDCWE-284
N/ACVSS
NVD MITRE
EPSS Score
0.4%
Top 64.9%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
Patch Available
Self-Check
Not available

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, the ThreadPolicy::edit() method contains a broken access control vulnerability that allows any authenticated user (regardless of role or mailbox access) to read and modify all customer-created thread messages across all mailboxes. This flaw enables silent modification of customer messages (evidence tampering), bypasses the entire mailbox permission model, and constitutes a GDPR/compliance violation. The issue has been fixed in version 1.8.209.

No summary for this CVE yet.

Weaknesses

CWE-284

Affected Products

freescout-help-desk
commercial
freescoutOn-premWeb App
Enterprise Software / itsm-monitoring
freescout
commercial
freescoutMixed
Enterprise Software / itsm-monitoring

Exploitability

Official Patch Available
Workaround Available

References

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wxg5-g9vv-v8g9
github.com
https://github.com/freescout-help-desk/freescout/commit/996a7f96337fdd8a1d1bbd0da0ec7ec85d160b11
github.com
https://github.com/freescout-help-desk/freescout/releases/tag/1.8.209
github.com

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-32752 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store