PT-2026-30898 · Freescout+1 · Freescout+1

Shukla304 + 1 · CVE-2026-39384 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.212

Description FreeScout, a help desk and shared inbox built with PHP's Laravel framework, does not properly consider the limit user customer visibility parameter when merging customers in versions prior to 1.8.212.

Recommendations Update to version 1.8.212 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-39384

GHSA-J6V9-22VQ-53VH

Affected Products

Freescout

Laravel

References · 7

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-j6v9-22vq-53vh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39384.json · Exploit
• https://github.com/freescout-help-desk/freescout/commit/b395a1179117af5e2df704c6bad71feeb301b4ce · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39384 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39384 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041570000331534424 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041570758829187167 · Twitter Post