PT-2026-38551 · Freescout · Freescout

Shukla304 · Published 2026-05-07 · Updated 2026-05-08 · CVE-2026-41906

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.214

Description The backend conversation change customer action fails to properly validate the customer email variable. While the Change Customer modal filters out-of-scope customers via the mailbox-filtered search endpoint, a low-privileged agent can forge a request to bind a visible conversation to a hidden customer in another mailbox.

Recommendations Update to version 1.8.214.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-41906

Affected Products

Freescout

References · 8

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-p6hg-2cwg-rrx9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41906 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.214 · Note
• https://twitter.com/VulmonFeeds/status/2052550718775570811 · Twitter Post
• https://twitter.com/infoflowcloud/status/2052479021053628544 · Twitter Post
• https://twitter.com/CVEnew/status/2052477951996751983 · Twitter Post
• https://t.me/CVEtracker/53006 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2052478621256720552 · Twitter Post