Is FreeScout affected by CVE-2026-40591?

FreeScout versions prior to 1.8.214 contain a privilege escalation vulnerability that allows low-privileged support agents to access and modify customer records across isolated mailboxes, directly undermining data segregation controls and customer confidentiality.

FreeScout CVE-2026-40591

EUVD-2026-24187 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-21 [email protected]

Authentication Bypass

7.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Apr 21, 2026 - 19:01 EUVD

Re-analysis Queued

Apr 21, 2026 - 18:22 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 17:37 vuln.today

DescriptionNVD

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the phone-conversation creation flow accepts attacker-controlled customer_id, name, to_email, and phone values and resolves the target customer in the backend without enforcing mailbox-scoped customer visibility. As a result, a low-privileged agent who can create a phone conversation in Mailbox A can bind the new Mailbox A phone conversation to a hidden customer from Mailbox B and add a new alias email to that hidden customer record by supplying to_email. Version 1.8.214 fixes the vulnerability.

AnalysisAI

Low-privileged agents in FreeScout can escalate mailbox access by exploiting insufficient customer visibility enforcement in phone conversation creation. Attackers with agent credentials for Mailbox A can reference and modify customer records from Mailbox B, adding alias emails to hidden customer profiles and bypassing mailbox isolation boundaries. …

RemediationAI

Within 24 hours: Identify all FreeScout installations and current versions in use; audit recent agent activity logs for cross-mailbox customer record modifications. Within 7 days: Upgrade all FreeScout instances to version 1.8.214 or later; review and restrict low-privileged agent role permissions to single-mailbox scope only. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-40591 vulnerability details – vuln.today

Back