CVE-2026-53591

{
  "id": "CVE-2026-53591",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T20:16:44.613",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted `In-Reply-To` header. No credentials, tokens, or prior access are required. The injected message is rendered in the agent UI as a legitimate customer reply, the conversation is automatically reopened, and the `last_reply_from` field is set to the attacker's identity. Version 1.8.223 contains a fix."
    },
    {
      "lang": "es",
      "value": "FreeScout es una mesa de ayuda gratuita y una bandeja de entrada compartida construida con el framework Laravel de PHP. Antes de la versión 1.8.223, un atacante no autenticado puede inyectar mensajes en cualquier conversación de soporte existente enviando un único correo electrónico a la dirección pública de la mesa de ayuda con un encabezado ’In-Reply-To’ manipulado. No se requieren credenciales, tokens ni acceso previo. El mensaje inyectado se muestra en la interfaz de usuario del agente como una respuesta legítima del cliente, la conversación se reabre automáticamente y el campo ’last_reply_from’ se establece con la identidad del atacante. La versión 1.8.223 contiene una solución."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "freescout-help-desk",
          "product": "freescout",
          "versions": [
            {
              "version": "< 1.8.223",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-20T20:15:06.613729Z",
          "id": "CVE-2026-53591",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-8vm3-wwq4-ggfx",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-8vm3-wwq4-ggfx",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}