freescout

v1.8.231 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 1d Communication & Email

✓ No known CVEs patched

This release patches 4 known CVEs

Topics

customer-support help-desk helpdesk helpdesk-ticketing helpscout laravel

+8 more

osticket-alternative php shared-mailboxes support ticketing ticketing-system zendesk zendesk-alternative

Affected surfaces

auth rbac

Summary

AI summary

GHSA-cr68-27qv-p5m4 security fix: customer visibility check added to load_customer_info ajax action.

Full changelog

Check customer visibility in load_customer_info ajax action (Security: GHSA-cr68-27qv-p5m4)
Restricted access to Assigned Conversations option in user profiles (GHSA-m4hc-rc98-38jc)
Change customer when received a reply to a conversation from completely new email address (Security: GHSA-j49f-9g94-3wh4)
Tighten throttling in Forgot Password requests (GHSA-jvmv-2qcp-7855)
Allow to define PHP path via PHP_PATH .env parameter for tools.php script (#5507)
Update customer in threads when merging customers (#5505)
Do not allow to send reply till all uploads finished (#5515)
Create a new conversation for email notifications forwarded to another mailbox (#4515)
Fixed missing space in browser push notifications (#5520)
Show warning on Status page when HTTPS is used but SESSION_SECURE_COOKIE=true is not set.
Make Shebang generic in update.sh and install.sh (#5521)

GHSA-cr68-27qv-p5m4 — added check of customer visibility in load_customer_info ajax action
GHSA-m4hc-rc98-38jc — restricted access to Assigned Conversations option in user profiles
GHSA-j49f-9g94-3wh4 — change customer when a reply arrives from an entirely new email address
GHSA-jvmv-2qcp-7855 — tightened throttling for Forgot Password requests

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track freescout

Get notified when new releases ship.

About freescout

FreeScout — Free self-hosted help desk & shared mailbox (Zendesk / Help Scout alternative)

v1.8.221 Links to attachments uploaded before 2020-03-06 will become unavailable.
v1.8.220 Replies to previously received email notifications will not be sent to customers.