CVE-2026-47123: FreeScout Email Spoofing Vulnerability – High-Severity Patch Available

Technical summary

CVE-2026-47123 exists in FreeScout's email processing pipeline, specifically in the FetchEmails command's notification reply path. The vulnerability stems from insufficient validation of the In-Reply-To and References email headers. When processing incoming messages, FreeScout extracts thread_id and user_id from a specially-crafted Message-ID pattern (notify-{thread_id}-{user_id}-...) without verifying the HMAC signature that should authenticate these identifiers. An attacker controlling or spoofing a sender address can craft a message that matches the expected reply pattern, bypassing the intended authentication mechanism. The message is then processed as a legitimate agent response and relayed to customers via SMTP, allowing unauthorized third-party message injection into customer conversations.

Business impact

This vulnerability creates a significant reputational and operational risk for FreeScout deployments. An attacker can send messages to customers while appearing to come from your support team, damaging customer trust and potentially leading to social engineering attacks, credential harvesting, or malware distribution under the guise of official support. Affected organizations may face customer complaints, brand erosion, and potential liability if sensitive information is compromised or fraudulent guidance is provided. The impact is heightened in security-conscious or regulated industries where communication integrity is critical.

Affected systems

FreeScout versions prior to 1.8.220 are affected. The vulnerability is specific to the email reply processing logic and affects any deployment that uses the FetchEmails command to ingest incoming mail, which is the standard operational mode for most FreeScout installations.

Exploitability

The vulnerability is remotely exploitable without authentication or user interaction. An attacker must be able to forge or control the From address in an email sent to the FreeScout inbox, a capability that requires either network access to relay infrastructure or compromise of email infrastructure upstream of FreeScout. The CVSS score of 7.5 (HIGH) reflects the network-based attack surface and the integrity impact on customer communications, though the AC:H (Attack Complexity: High) rating reflects the practical difficulty of reliably spoofing sender addresses in many email environments.

Remediation

Upgrade FreeScout to version 1.8.220 or later. This release implements HMAC verification for the thread_id and user_id parameters extracted from the Message-ID header, ensuring only legitimately-generated reply patterns are processed as agent responses. Organizations should test the upgrade in a staging environment first, then schedule deployment during a maintenance window to minimize disruption to help desk operations.

Patch guidance

Apply FreeScout version 1.8.220 immediately. No interim mitigations are documented. Because this affects core email processing functionality, the upgrade should be planned carefully to avoid email processing downtime. Verify your current version in the FreeScout admin panel (typically under Settings > About). Backup your database and configuration before upgrading. The upgrade process typically preserves all conversations and user data; consult the FreeScout upgrade documentation for your specific deployment method (Docker, standalone, etc.).

Detection guidance

Monitor FreeScout logs for unusual patterns in the FetchEmails command output or email processing pipeline. Look for messages that claim to be agent replies but originate from unexpected external email addresses or contain anomalous Message-ID headers. Check customer communication logs for messages that appear to come from your support team but were not authored by any user in your system. Implement email authentication (SPF, DKIM, DMARC) at your email gateway to reduce the likelihood of successful From address spoofing before messages reach FreeScout. Review any customer-reported 'unexpected messages from support' during the period before patching.

Why prioritize this

This vulnerability merits immediate patching due to its HIGH severity, remote exploitability, and direct impact on customer trust and communication integrity. The attack does not require authentication or user interaction, and successful exploitation immediately damages your organization's credibility with customers. The integrity impact (confidential information could be fraudulently communicated) combined with the cross-component nature (messages are relayed to customers via legitimate SMTP) elevates business risk significantly. Organizations running FreeScout should treat this as a critical priority.

Risk score, explained

CVSS 3.1 score of 7.5 reflects: Network-based attack vector (AV:N) requiring only internet connectivity; Attack Complexity: High due to the need to spoof email addresses, which varies by infrastructure; No privileges required (PR:N); No user interaction needed (UI:N); Scope: Changed because the impact affects systems beyond the vulnerable component (customer inboxes); Confidentiality impact: Low (attackers do not directly extract data from FreeScout); Integrity impact: High (attackers can inject unauthorized messages into customer communication). The HIGH severity appropriately captures the threat to operational integrity despite the AC:H mitigation factor.

Frequently asked questions