Unauthorized Access in FreeScout Help Desk System by Vendor

CVE-2026-40498

What is CVE-2026-40498?

The FreeScout Help Desk system allows unauthenticated attackers to gain access to sensitive diagnostic and system tools, originally intended for administrative use only. Prior to version 1.8.213, the vulnerability exists in the /system/cron endpoint, where a static MD5 hash derived from the APP_KEY is exposed. This exposure can lead to Full Path Disclosure, revealing internal server paths, process identifiers, and opens up opportunities for Resource Exhaustion attacks through automated requests that trigger resource-intensive background tasks without any mitigation. Additionally, this weak point allows the hash to be captured via GET requests, potentially being exposed in server logs, browser caches, and proxy logs, further complicating the security landscape.

References