CVE-2026-39384: FreeScout Customer Merge Cross-Mailbox Authorization Bypass

Q: What is the severity of CVE-2026-39384?

CVE-2026-39384 is considered a critical vulnerability due to its potential for unauthorized access across customer mailboxes.

Q: How do I fix CVE-2026-39384?

To fix CVE-2026-39384, upgrade FreeScout to version 1.8.212 or later.

Q: What does CVE-2026-39384 affect?

CVE-2026-39384 affects versions of FreeScout prior to 1.8.212, specifically concerning customer merging functionality.

Q: Can CVE-2026-39384 allow data leakage?

Yes, CVE-2026-39384 can allow unauthorized users to access customer data due to the authorization bypass.

Q: Is there a workaround for CVE-2026-39384?

There is no known workaround for CVE-2026-39384; the only effective measure is to upgrade to the patched version.

Published Apr 7, 2026

Updated

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limitusercustomervisibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.

Affected Software

2 affected components

Freescout freescout<1.8.212

Remediation

Patch Available

https://github.com/freescout-help-desk/freescout/commit/b395a1179117af5e2df704c6bad71feeb301b4ce

Event History

Apr 7, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-39384?

CVE-2026-39384 is considered a critical vulnerability due to its potential for unauthorized access across customer mailboxes.

How do I fix CVE-2026-39384?