CVE-2026-47123

{"id": "CVE-2026-47123", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47123", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T01:54:19.123127Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "freescout-help-desk", "product": "freescout", "versions": [{"status": "affected", "version": "< 1.8.220"}]}]}], "published": "2026-05-29T20:16:28.380", "references": [{"url": "https://github.com/freescout-help-desk/freescout/commit/d902f19038213c6a376947d269b00440908e88a0", "source": "security-advisories@github.com"}, {"url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6r38-6mcf-2ww3", "source": "security-advisories@github.com"}, {"url": "https://vincent.vulcoord.net/score/?state=Not+Scored&year=2026&year=2025&assigned_to=a165dae3-480e-4f7d-bbb8-9b1d78115b69&cve=CVE-2026-47123&analyze=1", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two code paths for identifying agent (user) replies based on In-Reply-To / References headers. The notification reply path (notify-{thread_id}-{user_id}-...) extracts thread_id and user_id directly from the Message-ID without HMAC verification. An external attacker who can spoof the From address of a helpdesk agent can inject messages that FreeScout processes as legitimate agent replies \u2014 which are then automatically forwarded to customers via the legitimate SMTP server. This vulnerability is fixed in 1.8.220."}, {"lang": "es", "value": "FreeScout es un help desk gratuito y una bandeja de entrada compartida construido con el framework Laravel de PHP. Antes de 1.8.220, la pipeline de procesamiento de correo electr\u00f3nico en el comando FetchEmails de FreeScout tiene dos rutas de c\u00f3digo para identificar respuestas de agentes (usuarios) basadas en los encabezados In-Reply-To / References. La ruta de respuesta de notificaci\u00f3n (notify-{thread_id}-{user_id}-...) extrae thread_id y user_id directamente del Message-ID sin verificaci\u00f3n HMAC. Un atacante externo que puede suplantar la direcci\u00f3n From de un agente de helpdesk puede inyectar mensajes que FreeScout procesa como respuestas leg\u00edtimas de agentes - los cuales son luego reenviados autom\u00e1ticamente a los clientes a trav\u00e9s del servidor SMTP leg\u00edtimo. Esta vulnerabilidad est\u00e1 corregida en 1.8.220."}], "lastModified": "2026-07-22T06:10:00.170", "sourceIdentifier": "security-advisories@github.com"}