Improper Access Control in FreeScout Help Desk

CVE-2026-103984

What is CVE-2026-103984?

Prior to version 1.8.231 of FreeScout, a self-hosted help desk tool, an improper access control vulnerability existed when the 'limit_user_customer_visibility' feature was enabled. This flaw allowed non-admin agents to exploit the load_customer_info AJAX action by providing an attacker-controlled customer email, which resulted in a global lookup that could reveal sensitive customer information. Specifically, this vulnerability permitted unauthorized access to a client's profile, exposing personal data such as names, email addresses, phone numbers, employment details, and internal agent notes. This significant risk highlights the importance of keeping FreeScout updated to avoid potential data breaches.

References