Which versions of FreeScout are affected by CVE-2026-40498?

FreeScout versions before 1.8.213 contain an unauthenticated remote vulnerability (CVSS 8.9) that allows attackers to bypass administrative access controls via predictable MD5 hashing of the APP_KEY,…. A patch is available.

How to fix or mitigate CVE-2026-40498?

Within 24 hours: Inventory all FreeScout instances and verify version numbers; immediately restrict network access to FreeScout administrative endpoints using firewall rules or WAF policies to allow only trusted IP ranges. Within 7 days: Contact FreeScout vendor to confirm patch timeline; if available, apply version 1.8.213 or later immediately; if unavailable, rotate APP_KEY and review server logs for unauthorized diagnostic endpoint access. Within 30 days: Implement network segmentation to isolate FreeScout from public internet exposure; deploy intrusion detection rules to alert on repeated administrative endpoint access; conduct forensic review of affected instances for evidence of compromise.

FreeScout CVE-2026-40498

Q: What is the CVSS score of CVE-2026-40498?

CVE-2026-40498 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-24137 HIGH

Information Exposure (CWE-200)

2026-04-21 GitHub_M

Denial Of Service Information Disclosure Freescout

8.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 22, 2026 - 17:34 nvd

Patch available

Re-analysis Queued

Apr 21, 2026 - 20:22 vuln.today

cvss_changed

Patch available

Apr 21, 2026 - 16:31 EUVD

Analysis Generated

Apr 21, 2026 - 16:31 vuln.today

CVSS changed

Apr 21, 2026 - 16:22 NVD

8.9 (HIGH)

EUVD ID Assigned

Apr 21, 2026 - 15:30 euvd

EUVD-2026-24137

Analysis Generated

Apr 21, 2026 - 15:30 vuln.today

CVE Published

Apr 21, 2026 - 15:01 nvd

HIGH 8.9

DescriptionGitHub Advisory

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP_KEY, which is exposed in the response and logs. Accessing these endpoints reveals sensitive server information (Full Path Disclosure), process IDs, and allows for Resource Exhaustion (DoS) by triggering heavy background tasks repeatedly without any rate limiting. The cron hash is generated using md5(APP_KEY . 'web_cron_hash'). Since this hash is often transmitted via GET requests, it is susceptible to exposure in server logs, browser history, and proxy logs. Furthermore, the lack of rate limiting on these endpoints allows for automated resource exhaustion (DoS) and brute-force attempts. Version 1.8.213 fixes the issue.

AnalysisAI

Unauthenticated remote attackers can access administrative diagnostic endpoints in FreeScout versions prior to 1.8.213, exploiting a predictable MD5 hash derived from the exposed APP_KEY. Attackers can harvest sensitive server information (full path disclosure, process IDs) and trigger resource exhaustion denial-of-service by repeatedly invoking unprotected background tasks. The vulnerability has publicly available exploit code (CVSS E:P), making it immediately actionable for attackers. EPSS data not provided, but the combination of network exposure (AV:N), no authentication required (PR:N), and confirmed POC significantly elevates real-world risk for internet-facing FreeScout installations.

Technical ContextAI

FreeScout is an open-source PHP-based help desk application that implements a web-accessible cron endpoint (/system/cron) for scheduled task execution. The vulnerability stems from authentication bypass (CWE-200: Information Exposure) where access control relies solely on a static token generated via md5(APP_KEY . 'web_cron_hash'). The APP_KEY, intended as a secret Laravel framework configuration value, becomes exposed through HTTP responses and server logs. Because the hash is transmitted via GET parameters, it persists in browser history, reverse proxy logs, and web server access logs. The MD5 algorithm's cryptographic weakness, combined with the static nature of the hash and lack of rate limiting, enables both brute-force attacks and replay attacks. The affected CPE (cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:*) indicates all versions before the 1.8.213 patch are vulnerable.

RemediationAI

Immediately upgrade to FreeScout version 1.8.213 or later, as confirmed in the release notes at https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213. The patch commit (https://github.com/freescout-help-desk/freescout/commit/b1d6c2c601a6ec3626ab13e679607b5084dfbd38) implements proper authentication and rate limiting on diagnostic endpoints. For installations where immediate patching is not feasible, implement network-level access controls: restrict /system/cron and other /system/* paths to localhost-only access via web server configuration (nginx location block or Apache .htaccess directives), though this will break legitimate external cron job triggers that rely on web-based scheduling. Alternatively, deploy a web application firewall rule blocking unauthenticated requests to /system/* paths, but this may interfere with legitimate administrative workflows. Rotate the APP_KEY environment variable after patching to invalidate any previously exposed hashes, though this requires updating all application configurations and may disrupt active sessions. Monitor web server logs for suspicious GET requests to /system/cron with hash parameters as indicators of reconnaissance or exploitation attempts. Note that network restrictions will prevent legitimate external monitoring tools from accessing diagnostic endpoints.