CVE-2026-40570

Published April 21st, 2026

View on NVD ↗

CVSS v3

N/A

CVSS v2

N/A

Affected

PROJECT

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` returns complete customer profile data to any authenticated user without verifying mailbox access. An attacker only needs a valid email address to retrieve all customer PII. Version 1.8.213 fixes the issue.

freescout-help-desk/freescout

FreeScout — Free self-hosted help desk & shared mailbox (Zendesk / Help Scout alternative)

GitHub

4.32K