Description (CNA)
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note (private thread) from any conversation, even after that user's access to the mailbox containing the conversation has been revoked. The ThreadPolicy::delete authorization policy does not verify mailbox membership, so a former team member retains destructive write access to notes they created. This vulnerability is fixed in 1.8.221.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| freescout-help-desk / freescout | affected < 1.8.221 |
CWE
CWE-862
References
ADP enrichment
No English description supplied.