What is the CVSS score of EUVD-2026-24187?

EUVD-2026-24187 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of FreeScout are affected by EUVD-2026-24187?

FreeScout versions prior to 1.8.214 contain a privilege escalation vulnerability that allows low-privileged support agents to access and modify customer records across isolated mailboxes, directly…. A patch is available.

How to fix or mitigate EUVD-2026-24187?

Within 24 hours: Identify all FreeScout installations and current versions in use; audit recent agent activity logs for cross-mailbox customer record modifications. Within 7 days: Upgrade all FreeScout instances to version 1.8.214 or later; review and restrict low-privileged agent role permissions to single-mailbox scope only. Within 30 days: Conduct forensic review of agent access logs from the past 90 days for unauthorized cross-mailbox customer data access; notify affected customers if unauthorized access is confirmed; implement mandatory mailbox isolation verification testing.

FreeScout EUVD-2026-24187

| CVE-2026-40591 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-21 security-advisories@github.com

Authentication Bypass

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 22, 2026 - 21:10 nvd

Patch available

Apr 21, 2026 - 19:01 EUVD

Re-analysis Queued

Apr 21, 2026 - 18:22 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 17:37 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 17:22 euvd

EUVD-2026-24187

Analysis Generated

Apr 21, 2026 - 17:22 vuln.today

CVE Published

Apr 21, 2026 - 17:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the phone-conversation creation flow accepts attacker-controlled customer_id, name, to_email, and phone values and resolves the target customer in the backend without enforcing mailbox-scoped customer visibility. As a result, a low-privileged agent who can create a phone conversation in Mailbox A can bind the new Mailbox A phone conversation to a hidden customer from Mailbox B and add a new alias email to that hidden customer record by supplying to_email. Version 1.8.214 fixes the vulnerability.

AnalysisAI

Low-privileged agents in FreeScout can escalate mailbox access by exploiting insufficient customer visibility enforcement in phone conversation creation. Attackers with agent credentials for Mailbox A can reference and modify customer records from Mailbox B, adding alias emails to hidden customer profiles and bypassing mailbox isolation boundaries. This constitutes an authentication bypass enabling cross-mailbox data manipulation. Fixed in version 1.8.214. EPSS data not provided; no CISA KEV listing at time of analysis. GitHub security advisory and upstream commit confirm the vulnerability and patch.

Technical ContextAI

FreeScout is a self-hosted help desk system with multi-mailbox architecture designed to isolate customer data between mailboxes. The vulnerability exists in the phone conversation creation API endpoint, which accepts customer_id, name, to_email, and phone parameters from authenticated agents. The backend fails to validate that the referenced customer_id belongs to the mailbox the agent has access to, violating CWE-639 (Authorization Bypass Through User-Controlled Key). This represents a broken access control scenario where object-level authorization is not enforced, allowing horizontal privilege escalation between mailbox contexts. The phone conversation workflow accepts arbitrary customer identifiers and email addresses, directly modifying customer records without scope validation. CPE data not provided in input, but affected product is the FreeScout application prior to version 1.8.214.

RemediationAI

Upgrade to FreeScout version 1.8.214 or later, available at https://github.com/freescout-help-desk/freescout/releases/tag/1.8.214. The fix implemented in commit 83eea1ca47d97c6cdc90c501734bc2579b014a34 enforces mailbox-scoped customer visibility validation during phone conversation creation. For systems unable to immediately upgrade, implement compensating controls by restricting agent permissions to prevent phone conversation creation, though this significantly limits help desk functionality. Alternatively, audit phone conversation creation API access logs for suspicious cross-mailbox customer_id references and monitor for unexpected customer email alias additions. Post-upgrade, review existing phone conversation records created prior to patching for potentially unauthorized cross-mailbox customer associations and verify customer email alias integrity across all mailboxes. No workaround preserves full functionality; immediate patching is strongly recommended for multi-mailbox deployments.