CVE-2026-40496: FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable formula: md5(APPKEY + attachmentid + size). Since attachmentid is sequential and size can be brute-forced in a small range, an unauthenticated attacker can forge valid tokens and download any private attachment without credentials. Version 1.8.213 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40496?
CVE-2026-40496 has a high severity due to its potential for unauthenticated access to private files.
How do I fix CVE-2026-40496?
To mitigate CVE-2026-40496, upgrade to FreeScout version 1.8.213 or later.
What kind of attack can exploit CVE-2026-40496?
CVE-2026-40496 can be exploited through brute force attacks on attachment download tokens.
What versions of FreeScout are affected by CVE-2026-40496?
FreeScout versions prior to 1.8.213 are affected by CVE-2026-40496.
What is the nature of the vulnerability in CVE-2026-40496?
CVE-2026-40496 involves a predictable attachment token that allows for unauthorized file downloads.