FreeScout is a free self-hosted help desk and shared mailbox application. Prior to version 1.8.215, the MailboxesController::updateSave() function persists chat_start_new outside the allowed-field filter. This vulnerability allows users with only the mailbox signature permission to change hidden mailbox-wide chat settings through direct POST requests, bypassing UI restrictions. The vulnerability represents a privilege escalation where restricted users can modify settings they should not have access to. Version 1.8.215 addresses this security flaw.