Freescout CVE-2026-39384

Requires authenticated access as a FreeScout user with customer management permissions. Attacker must merge customers while limit_user_customer_visibility parameter is not properly enforced in FreeScout versions prior to 1.8.212. No victim interaction needed.

Real-world risk is moderate-to-high for multi-tenant FreeScout deployments. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity requiring only low-privilege authenticated access, making this readily exploitable by any authenticated agent. The impact profile (C:L/I:H/A:L) shows high integrity impact, which aligns with unauthorized data modification during merges, plus limited confidentiality and availability impacts. However, exploitability requires the organization to have implemented customer visibility restrictions-deployments without this feature enabled are unaffected. No KEV listing indicates no confirmed active exploitation, and no public proof-of-concept exists at time of analysis. The Authentication Bypass tag is somewhat misleading; this is authorization bypass, not authentication bypass-attackers must be authenticated users. For organizations using customer segmentation features (common in managed service providers or multi-client support teams), this represents a genuine business risk as agents could access competitor data or violate contractual data isolation requirements. For single-client deployments or those not using visibility restrictions, operational risk is minimal.

An authenticated support agent restricted to viewing only Customer A's tickets discovers they can exploit the merge function to access Customer B's data. The agent initiates a customer merge operation through the FreeScout interface, specifying Customer B (outside their authorized scope) as the merge target. Due to the missing authorization check, the system processes the merge without validating the agent's permission to access Customer B. The agent now gains read access to Customer B's contact information, ticket history, and potentially sensitive support communications. They could also modify Customer B's data by merging incorrect information, corrupting the customer record. This scenario is particularly damaging in managed service provider environments where competitors' data must remain isolated, or in healthcare/legal contexts with strict confidentiality requirements.