Which versions of Freescout are affected by CVE-2026-40496?

FreeScout versions prior to 1.8.213 contain a critical token generation flaw that allows unauthenticated attackers to download all private email attachments by predicting weak MD5-based security…. A patch is available.

How to fix or mitigate CVE-2026-40496?

Within 24 hours: identify all FreeScout deployments and document current versions. Within 7 days: apply vendor patch to FreeScout version 1.8.213 or later on all instances; verify patch installation and restart services. Within 30 days: conduct audit of attachment access logs (if available) to identify suspicious token-based downloads; notify customers or stakeholders if sensitive attachments were potentially exposed.

Freescout CVE-2026-40496

Q: What is the CVSS score of CVE-2026-40496?

CVE-2026-40496 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-24049 HIGH

Use of Insufficiently Random Values (CWE-330)

2026-04-21 GitHub_M

Information Disclosure Freescout

8.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 23, 2026 - 16:32 nvd

Patch available

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 04:29 vuln.today

Patch available

Apr 21, 2026 - 03:01 EUVD

CVSS changed

Apr 21, 2026 - 02:22 NVD

8.8 (HIGH)

EUVD ID Assigned

Apr 21, 2026 - 02:00 euvd

EUVD-2026-24049

Analysis Generated

Apr 21, 2026 - 02:00 vuln.today

CVE Published

Apr 21, 2026 - 01:38 nvd

HIGH 8.8

DescriptionGitHub Advisory

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable formula: md5(APP_KEY + attachment_id + size). Since attachment_id is sequential and size can be brute-forced in a small range, an unauthenticated attacker can forge valid tokens and download any private attachment without credentials. Version 1.8.213 fixes the issue.

AnalysisAI

Insecure token generation in FreeScout <1.8.213 allows unauthenticated remote attackers to download private email attachments by forging MD5-based download tokens. The predictable formula (md5(APP_KEY + sequential_attachment_id + guessable_size)) enables enumeration of all stored attachments without credentials. CVSS 8.8 reflects high confidentiality and integrity impact via network vector with no authentication required. EPSS data not provided. Proof-of-concept exploitation exists (E:P in CVSS vector). Vendor-released patch version 1.8.213 available via GitHub.

Technical ContextAI

FreeScout is a self-hosted open-source help desk and shared mailbox system built on PHP/Laravel. The vulnerability exists in the attachment access control mechanism which generates download authorization tokens using MD5(APP_KEY + attachment_id + size). This falls under CWE-330 (Use of Insufficiently Random Values) because the token generation relies on predictable inputs: attachment_id values are sequential integers assigned to database records, file sizes occupy a narrow numeric range (typically bytes to megabytes), and APP_KEY is a Laravel application secret that remains constant per installation. MD5 is a fast cryptographic hash, enabling rapid brute-force attempts. An attacker can iterate through sequential attachment_id values combined with common file sizes to generate candidate tokens and systematically harvest all attachments stored in the system. The affected product per CPE is cpe:2.3:a:freescout-help-desk:freescout for all versions prior to 1.8.213.

RemediationAI

Immediate upgrade to FreeScout version 1.8.213 or later is the primary remediation, available from https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213. The fix implemented in commit dbdf8f2260b43a21818255c70f0b61b9de9cd555 replaces the weak token formula with cryptographically secure random token generation. For organizations unable to immediately upgrade, implement compensating controls: restrict network access to FreeScout web interface to authenticated VPN users only (eliminates unauthenticated remote attack vector but prevents external customer access), deploy web application firewall rules to rate-limit /download or attachment endpoint requests (slows enumeration attacks but determined attackers can still succeed over time), or temporarily disable attachment features if operationally feasible (breaks core help desk functionality). All compensating controls have significant operational trade-offs and should be considered temporary measures only. Post-upgrade, audit server logs for suspicious sequential attachment download patterns from single IPs to identify potential prior exploitation. Rotate APP_KEY after patching if logs indicate compromise, as existing tokens generated with old formula may remain valid in user sessions. Review all attachments accessed during the vulnerability window for unauthorized disclosure of sensitive data.