CVE-2026-40570 PUBLISHED

FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII

Assigner: GitHub_M
Reserved: 14.04.2026 Published: 21.04.2026 Updated: 21.04.2026

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the load_customer_info action in POST /conversation/ajax returns complete customer profile data to any authenticated user without verifying mailbox access. An attacker only needs a valid email address to retrieve all customer PII. Version 1.8.213 fixes the issue.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CVSS Score: 5.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	freescout-help-desk
Product	freescout
Versions	Version < 1.8.213 is affected

References

Problem Types

CWE-639: Authorization Bypass Through User-Controlled Key CWE
CWE-862: Missing Authorization CWE