CVE-2026-47123— FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path
Possible ATT&CK Techniques 1AI
T1566.002 · Spearphishing LinkGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47123
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path
Source: NVD (National Vulnerability Database)
Vulnerability Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two code paths for identifying agent (user) replies based on In-Reply-To / References headers. The notification reply path (notify-{thread_id}-{user_id}-...) extracts thread_id and user_id directly from the Message-ID without HMAC verification. An external attacker who can spoof the From address of a helpdesk agent can inject messages that FreeScout processes as legitimate agent replies — which are then automatically forwarded to customers via the legitimate SMTP server. This vulnerability is fixed in 1.8.220.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用欺骗进行的认证绕过
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| freescout-help-desk | freescout | < 1.8.220 | - |
II. Public POCs for CVE-2026-47123
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47123
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-47123 (1)
Vendor Advisories for CVE-2026-47123 (1)
Same Patch Batch · freescout-help-desk · 2026-05-29 · 4 CVEs total
| CVE-2026-45294 | 5.3 MEDIUM | FreeScout: User Account Enumeration via Password Reset Response Differentiation |
| CVE-2026-48811 | 4.3 MEDIUM | FreeScout: Thread Deletion Bypasses Mailbox Access Revocation |
| CVE-2026-48810 | 4.3 MEDIUM | FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check |
IV. Related Vulnerabilities
Same product: freescout
- CVE-2026-45294
FreeScout: User Account Enumeration via Password Reset Respo - CVE-2026-48810
FreeScout: Thread Edit Authorization Bypass via Missing Mail - CVE-2026-48811
FreeScout: Thread Deletion Bypasses Mailbox Access Revocatio - CVE-2026-41906
FreeScout: Conversation Change-Customer Cross-Mailbox Author - CVE-2026-41905
FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl:
Same vendor: freescout-help-desk
- CVE-2026-45294
FreeScout: User Account Enumeration via Password Reset Respo - CVE-2026-48810
FreeScout: Thread Edit Authorization Bypass via Missing Mail - CVE-2026-48811
FreeScout: Thread Deletion Bypasses Mailbox Access Revocatio - CVE-2026-41906
FreeScout: Conversation Change-Customer Cross-Mailbox Author - CVE-2026-41905
FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl:
Same weakness: CWE-290
- CVE-2026-44649
SillyTavern: Authentication Bypass via SSO Header Injection - CVE-2026-46414
Microsoft UFO WebSocket role spoofing allows authenticated p - CVE-2026-8676
Silicon Simplicity SDK 安全漏洞 - CVE-2018-25361
Soroush IM Desktop App 0.17.0 Authentication Bypass via Data - CVE-2026-7507
Org.keycloak/keycloak-services: session fixation in oidc log
V. Comments for CVE-2026-47123
No comments yet