CVE-2026-103984: FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limitusercustomervisibility is enabled, the loadcustomerinfo AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.