PT-2026-30898 · Freescout Help Desk · Freescout

Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39384

NVD

CVSS v3.1

7.6

High

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit user customer visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-39384

Affected Products

Freescout

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39384 · Security Note
• https://github.com/freescout-help-desk/freescout/commit/b395a1179117af5e2df704c6bad71feeb301b4ce · Note
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-j6v9-22vq-53vh · Note