FreeScout Attachment Flaw Allows Data Deletion

A critical vulnerability, CVE-2026-41192, has been identified in FreeScout, a popular self-hosted help desk solution. According to the National Vulnerability Database, versions prior to 1.8.215 are susceptible to an attachment deletion flaw with a CVSS score of 7.1 (HIGH).

The issue stems from how FreeScout handles client-supplied encrypted attachment IDs during reply and draft workflows. The National Vulnerability Database explains that any IDs present in attachments_all[] but omitted from retained lists are decrypted and directly passed to Attachment::deleteByIds(). This means a mailbox peer can replay valid, encrypted attachment IDs from a visible conversation via the save_draft function, effectively deleting the original attachment file and its corresponding database entry.

This isn’t just a nuisance; it’s a data integrity nightmare. While the National Vulnerability Database indicates the vulnerability doesn’t directly lead to confidentiality compromise, the ability for an authenticated peer to arbitrarily delete attachments can disrupt operations, obscure evidence, and potentially facilitate further social engineering attacks by removing crucial context. Version 1.8.215 addresses this flaw, tightening the trust boundaries around attachment ID handling.