CVE-2026-39384

HIGH

FreeScout Customer Merge Cross-Mailbox Authorization Bypass

Title source: cna

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.

References (2)

Scores

CVSS v3 7.6
EPSS 0.0004
EPSS Percentile 12.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (2)
freescout/freescout < 1.8.212
freescout-help-desk/freescout < 1.8.212
Published Apr 07, 2026
Tracked Since Apr 07, 2026