PT-2026-34024 · Freescout Help Desk · Freescout

Published 2026-04-21 · Updated 2026-04-27 · CVE-2026-40589

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.214

Description A low-privileged agent can edit a visible customer and add an email address that is already owned by a hidden customer in another mailbox. This action causes the server to disclose the hidden customer's name and profile URL in the success flash, reassign the hidden email to the visible customer, and rebind conversations from the hidden mailbox associated with that email to the visible customer.

Recommendations Update to version 1.8.214.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-40589

Affected Products

Freescout

References · 6

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-mv55-3mgv-fxwr · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40589 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.214 · Note
• https://github.com/freescout-help-desk/freescout/commit/2e2fe37111d92ac665b9ad8806eac94a1a3e502c · Note
• https://twitter.com/infoflowcloud/status/2048911706361884960 · Twitter Post
• https://twitter.com/CVEnew/status/2048910163508424925 · Twitter Post