VulnSocial

CVE-2026-41903Disclosure

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user holding the PERM_EDIT_USERS permission (intended for general user-profile editing) can read and modify the notification subscriptions of any other user, including admins, by sending a single POST request. This is a sibling of CVE-2025-48472's notification authorization bypass — the prior fix did not cover this code path. A non-admin attacker can silently disable an admin's email/browser/mobile notifications, suppressing security alerts and conversation-assignment notices. This issue has been patched in version 1.8.217.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-05-07); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-05-07: 2Mentions · 2026-05-08: 1Technical Details · 2026-05-07: 1Technical Details · 2026-05-08: 105-0705-08
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-072
Disclosure1General1
2026-05-081
Disclosure1
Full discourse3 posts
  • CVE@CVEnew
    General

    CVE-2026-41903 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user holding the PERM_EDIT_USERS permission (intended f… https://www.cve.org/CVERecord?id=CVE-2026-41903

    Post summary

    The text announces CVE‑2026‑41903 for FreeScout, noting a permission issue before v1.8.217, but provides no further technical or exploit details.

    00010272
    57.4K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-41903 Unauthorized Notification Subscription Modification in FreeScout Before 1.8.217 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41903

    Post summary

    The text announces CVE-2026-41903, noting unauthorized notification subscription modification in FreeScout versions before 1.8.217, but provides minimal details and no actionable information.

    0000042
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-41903 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user holding the PERM_EDIT_USERS permission (intended f… https://www.cve.org/CVERecord?id=CVE-2026-41903 ----- Traducción: CVE-2026-41903 Fre… http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-41903 for FreeScout, noting a flaw affecting users with PERM_EDIT_USERS permission before version 1.8.217.

    0000046
    75 followersView on X

Explore more

Back to dashboard