PT-2026-33992 · Freescout · Freescout

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40498

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.213

Description An unauthenticated attacker can access diagnostic and system tools intended for administrators. The '/system/cron' endpoint uses a static MD5 hash derived from the APP KEY variable, which is exposed in responses and logs. This allows for Full Path Disclosure (revealing sensitive server paths), exposure of process IDs, and Resource Exhaustion (DoS) by repeatedly triggering heavy background tasks due to a lack of rate limiting. The hash is generated using the md5(APP KEY . 'web cron hash') function and is susceptible to exposure via GET requests in server logs, browser history, and proxy logs.

Recommendations Update to version 1.8.213.

Exploit

Fix

Improper Access Control

Information Disclosure

Allocation of Resources Without Limits

Weakness Enumeration

CWE-284

CWE-200

CWE-770

Related Identifiers

CVE-2026-40498

Affected Products

Freescout

References · 6

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5jw5-q9j7-4rxc · Exploit
• https://github.com/freescout-help-desk/freescout/commit/b1d6c2c601a6ec3626ab13e679607b5084dfbd38 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40498 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213 · Note
• https://twitter.com/CVEnew/status/2046620097897168919 · Twitter Post
• https://twitter.com/infoflowcloud/status/2046622274069954872 · Twitter Post