CVE-2026-103984Medium· 6.5▾ TwilightPoC availableFreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.
freescout < 1.8.231Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103985High· 7.1FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
CVE-2026-62852Medium· 6.5FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key
CVE-2026-62855Medium· 4.4FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files
CVE-2026-107393Medium· 6.1FreeScout is a self-hosted help desk and shared mailbox
CVE-2026-62854High· 7.6FreeScout: Stored XSS in mailbox signature via same-origin JS upload
CVE-2026-62851Medium· 4.3FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortcut (missing mailbox authorization)