freescout-help-desk FreeScout up to 1.8.230 Customer Data Retrieval load_customer_info customer_email/mailbox privileges management

Summaryinfo

A vulnerability was found in freescout-help-desk FreeScout up to 1.8.230 and classified as problematic. This affects the function load_customer_info of the component Customer Data Retrieval. Such manipulation of the argument customer_email/mailbox leads to privileges management. This vulnerability is traded as CVE-2026-103984. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in freescout-help-desk FreeScout up to 1.8.230. It has been rated as problematic. Affected by this issue is the function load_customer_info of the component Customer Data Retrieval. The manipulation of the argument customer_email/mailbox with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality. CVE summarizes:

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-103984 since 10/01/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.8.231 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• freescout-help-desk

Name

• FreeScout

Version

• 1.8.230

Website

• Product: https://github.com/freescout-help-desk/freescout/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion