Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note (private thread) from any conversation, even after that user's access to the mailbox containing the conversation has been revoked. The ThreadPolicy::delete authorization policy does not verify mailbox membership, so a former team member retains destructive write access to notes they created. This vulnerability is fixed in 1.8.221.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-48811 Unauthorized Internal Note Deletion in FreeScout Before 1.8.221 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48811
Post summary
The post announces CVE-2026-48811, describing unauthorized internal note deletion in FreeScout versions before 1.8.221. It includes a link for additional details but lacks PoC, exploit, or patch information.