GHSA-cr68-27qv-p5m4: FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limitusercustomervisibility is enabled, the loadcustomerinfo AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeScoutto a version that resolves this vulnerability.Fixed in 1.8.231
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeScout instances running versions before 1.8.231 are affected when limit_user_customer_visibility is enabled. The issue can be exploited by a non-admin agent who has access to at least one mailbox.
What does an attacker need to retrieve another customer's information?
The attacker needs an accessible mailbox to supply with the AJAX request and the email address of the customer they want to look up. The targeted customer does not need to be associated with that mailbox.
What information could be disclosed?
The rendered customer profile may expose names, email addresses, phone numbers, company and job details, postal addresses, social profiles, websites, and confidential internal agent notes.
How can this be remediated?
Upgrade FreeScout to version 1.8.231, which fixes the issue.