CVE-2026-40592 - FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply

CVE ID :CVE-2026-40592 Published : April 21, 2026, 5:16 p.m. | 56 minutes ago Description :FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks only whether the current user can view the pa