CVE-2026-40570: FreeScout Information Disclosure Flaw

CVE-2026-40570 Overview

FreeScout, a popular open-source self-hosted help desk and shared mailbox solution, contains an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.8.213. The load_customer_info action in the POST /conversation/ajax endpoint returns complete customer profile data to any authenticated user without verifying whether the user has legitimate access to the associated mailbox. An attacker with valid authentication credentials only needs to provide a target email address to retrieve all customer personally identifiable information (PII).

Critical Impact

Any authenticated FreeScout user can extract complete customer PII including contact information and support history by exploiting the missing mailbox access verification, leading to potential mass data exfiltration and privacy violations.

Affected Products

• FreeScout versions prior to 1.8.213
• Self-hosted FreeScout help desk deployments
• FreeScout shared mailbox installations

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40570 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40570

Vulnerability Analysis

This vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as an Insecure Direct Object Reference (IDOR). The flaw exists in the conversation AJAX handler where the load_customer_info action processes requests without implementing proper authorization checks.

When an authenticated user sends a POST request to /conversation/ajax with the load_customer_info action and an email address parameter, the application retrieves and returns the complete customer profile associated with that email. The critical security gap is that the endpoint fails to verify whether the requesting user has access to the mailbox containing conversations with that customer.

This authorization bypass allows any user with valid credentials—even those with minimal privileges—to enumerate and extract customer data across the entire FreeScout installation. The attack surface is significant because help desk systems typically store sensitive customer information including names, email addresses, phone numbers, addresses, and complete support interaction histories.

Root Cause

The root cause is a missing authorization check in the load_customer_info action handler. The endpoint authenticates the user (verifying they have a valid session) but fails to authorize the request by checking mailbox membership or access permissions. This violates the principle of least privilege and allows horizontal privilege escalation where users can access data belonging to mailboxes they are not assigned to.

Attack Vector

The attack is network-based and requires low privileges—only valid authentication credentials for any FreeScout account. The exploitation flow involves an authenticated attacker sending crafted POST requests to the /conversation/ajax endpoint with the load_customer_info action parameter and target email addresses. Since the endpoint lacks mailbox access verification, the server responds with complete customer profile data regardless of whether the attacker's account has legitimate access to view that customer's information.

An attacker could automate this process to systematically extract PII for all customers in the system by iterating through known or guessed email addresses. The vulnerability requires no user interaction and can be exploited silently without generating obvious alerts.

Detection Methods for CVE-2026-40570

Indicators of Compromise

• Unusual volume of POST requests to /conversation/ajax from a single user session
• Multiple load_customer_info action requests with different email addresses in rapid succession
• Access patterns showing users querying customer data outside their assigned mailboxes
• Authenticated sessions making customer lookup requests without corresponding conversation views

Detection Strategies

• Implement web application firewall rules to monitor and rate-limit requests to /conversation/ajax endpoints
• Enable detailed access logging for all customer data retrieval operations
• Deploy anomaly detection to identify users accessing customer records outside normal behavioral patterns
• Review authentication logs for accounts making bulk customer information requests

Monitoring Recommendations

• Configure alerts for high-frequency requests to the conversation AJAX endpoint per user session
• Monitor for automated tool signatures such as scripted request patterns or missing browser headers
• Establish baseline metrics for normal customer lookup behavior and alert on deviations
• Implement audit logging that captures which users accessed which customer records

How to Mitigate CVE-2026-40570

Immediate Actions Required

• Upgrade FreeScout to version 1.8.213 or later immediately
• Review access logs to identify potential exploitation attempts prior to patching
• Audit user accounts for suspicious activity patterns involving customer data access
• Consider temporarily restricting access to the FreeScout instance until patched

Patch Information

FreeScout version 1.8.213 addresses this vulnerability by implementing proper mailbox access verification before returning customer profile data. The fix is available through the official GitHub Release 1.8.213. The specific code changes can be reviewed in the GitHub Commit Update. Additional vulnerability details are documented in the GitHub Security Advisory GHSA-w77q-wjfp-c822.

Workarounds

• Restrict network access to FreeScout to trusted IP ranges using firewall rules
• Implement web application firewall rules to rate-limit or block suspicious requests to /conversation/ajax
• Reduce the number of user accounts with access to the FreeScout system to minimize attack surface
• Enable additional authentication factors to make credential compromise more difficult

# Example: Restrict access to FreeScout via nginx configuration
location /conversation/ajax {
    # Rate limit requests to the vulnerable endpoint
    limit_req zone=ajax_limit burst=10 nodelay;
    
    # Restrict to trusted networks until patch is applied
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    proxy_pass http://freescout_backend;
}