CVE-2026-53591 | FreeScout is a free help desk and shared inbox built with PH… | CVSS 8.6 HIGH

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted `In-Reply-To` header. No credentials, tokens, or prior access are required. The injected message is rendered in the agent UI as a legitimate customer reply, the conversation is automatically reopened, and the `last_reply_from` field is set to the attacker's identity. Version 1.8.223 contains a fix.

Metadata

CVE ID: CVE-2026-53591
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-09 19:11 UTC
Published: 2026-07-20 19:47 UTC
Last updated: 2026-07-20 20:15 UTC
Primary CWE: CWE-287
CWE-287: Improper Authentication
Vendor / Product: freescout-help-desk / freescout
Sources: cve.org · NVD

Severity & Metrics

8.6 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
freescout-help-desk	freescout	—	< 1.8.223

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	CWE-287: Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.6	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References (1)

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-8vm3-wwq4-ggfx https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-8vm3-wwq4-ggfx