CVE-2026-47123: FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path

Synopsis

This is an agent impersonation flaw in FreeScout, a PHP/Laravel help desk application, caused by missing HMAC verification on the notification reply Message-ID path in the FetchEmails command. The bug is reachable over the network without authentication: an attacker who can spoof a helpdesk agent's From address can inject email that FreeScout treats as a legitimate agent reply, then forwards to the customer through the configured SMTP server. Successful exploitation lets the attacker send messages to customers under a real agent identity via the helpdesk's own infrastructure. A patched-image rebuild at 1.8.220 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to deliver email to the inbox FreeScout polls, reaching the service over the network via SMTP.

• AuthenticationNot required

  No FreeScout account or credentials are needed; the attacker only needs to spoof an agent's From address on an inbound message.

• Victim interactionNot required

  FreeScout processes the spoofed message automatically through FetchEmails and forwards it to the customer without any agent or admin action.

• Attack complexityDetail

  Complexity is rated High: the attacker must know or guess valid thread_id and user_id values and bypass any sender-side SPF, DKIM, or DMARC enforcement to land the spoofed mail.

Blast Radius

• Sends arbitrary messages to customers from a real agent identity using the helpdesk's legitimate SMTP server, enabling phishing and social engineering under a trusted brand.
• Injects forged replies into existing support threads, tampering with the conversation record customers and agents rely on.
• Damages the integrity of the help desk audit trail, since spoofed messages are stored as genuine agent replies.