Improper Access Control in FreeScout Help Desk Platform
CVE-2026-40591
7.1HIGH
What is CVE-2026-40591?
FreeScout, a self-hosted help desk solution, experienced a vulnerability where low-privileged agents could manipulate the phone-conversation creation flow. Prior to version 1.8.214, the system allowed agents to submit attacker-controlled inputs, such as 'customer_id', 'name', 'to_email', and 'phone'. This lack of proper visibility enforcement granted unauthorized access to customer details across different mailboxes, enabling agents to bind phone conversations to hidden customer records and add email aliases. Version 1.8.214 has addressed this vulnerability, enhancing security measures.
Affected Version(s)
freescout < 1.8.214