Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks only whether the current user can view the parent conversation. It does not verify that the current user created the reply being undone. In a shared mailbox, one agent can therefore recall another agent's just-sent reply during the 15-second undo window. Version 1.8.214 fixes the vulnerability.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-40592 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks only whe… https://www.cve.org/CVERecord?id=CVE-2026-40592
Post summary
The text announces CVE-2026-40592 with a brief technical description of the vulnerability in FreeScout, but does not supply a PoC, exploit tool, patch, or evidence of exploitation.
🚨*CVE* CVE-2026-40592 FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks only whe… https://www.cve.org/CVERecord?id=CVE-2026-40592 ----- Traducción: CVE-2026-40592 Fre… http://infoflow.cloud`
Post summary
The post highlights a flaw in FreeScout’s undo‑send route that was present before v1.8.214 and references a patch that addresses the vulnerability.