freescout-help-desk freescout up to 1.8.212 GET Request /system/cron information disclosure

Summaryinfo

A vulnerability classified as problematic has been found in freescout-help-desk freescout up to 1.8.212. The impacted element is an unknown function of the file /system/cron of the component GET Request Handler. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2026-40498. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in freescout-help-desk freescout up to 1.8.212. This affects some unknown processing of the file /system/cron of the component GET Request Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP_KEY, which is exposed in the response and logs. Accessing these endpoints reveals sensitive server information (Full Path Disclosure), process IDs, and allows for Resource Exhaustion (DoS) by triggering heavy background tasks repeatedly without any rate limiting. The cron hash is generated using md5(APP_KEY . 'web_cron_hash'). Since this hash is often transmitted via GET requests, it is susceptible to exposure in server logs, browser history, and proxy logs. Furthermore, the lack of rate limiting on these endpoints allows for automated resource exhaustion (DoS) and brute-force attempts. Version 1.8.213 fixes the issue.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-40498 since 04/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

It is declared as proof-of-concept.

Upgrading to version 1.8.213 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• freescout-help-desk

Name

• freescout

Version

• 1.8.212

Website

• Product: https://github.com/freescout-help-desk/freescout/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion