FreeScout Vulnerability Allows Silent Email Exfiltration and Hijacking

The National Vulnerability Database has detailed a critical mass assignment flaw in FreeScout, a self-hosted help desk solution. Versions prior to 1.8.213 are affected by this vulnerability, which resides in the mailbox connection settings endpoints. Attackers with authenticated admin privileges can exploit this by injecting hidden parameters into connection save requests. This allows them to silently redirect all outgoing emails to an attacker-controlled address (via auto_bcc) or even hijack the outgoing SMTP server.

This flaw is particularly concerning as it bypasses standard form validation and can be exploited invisibly. An attacker could inject malicious content like tracking pixels or phishing links into email signatures, or configure rogue auto-replies. The National Vulnerability Database highlights that in multi-admin environments, one administrator can conduct covert surveillance on mailboxes managed by others. Furthermore, if an admin session is compromised through other means, like XSS, this vulnerability provides a persistent channel for data exfiltration that survives session expiry.

Defenders using FreeScout should immediately update to version 1.8.213 or later. For organizations unable to patch promptly, a thorough audit of mailbox connection and general mailbox settings for any unexpected configurations, particularly auto_bcc and out_server parameters, is crucial. Given the critical CVSS score of 9, this vulnerability warrants immediate attention.