CVE-2026-40591 Overview
CVE-2026-40591 is an Insecure Direct Object Reference (IDOR) vulnerability in FreeScout, a popular free self-hosted help desk and shared mailbox solution. The vulnerability exists in the phone-conversation creation flow, which accepts attacker-controlled parameters including customer_id, name, to_email, and phone values without properly enforcing mailbox-scoped customer visibility checks on the backend.
This broken access control flaw allows a low-privileged agent with access to one mailbox to bind phone conversations to customers from other mailboxes they should not have access to, and potentially modify customer records by adding alias email addresses.
Critical Impact
A low-privileged agent can access and modify customer records across mailbox boundaries, leading to unauthorized data access and potential data integrity issues in multi-tenant FreeScout deployments.
Affected Products
- FreeScout versions prior to 1.8.214
- Self-hosted FreeScout installations with multiple mailboxes
- Multi-agent deployments with compartmentalized mailbox access
Discovery Timeline
- 2026-04-21 - CVE-2026-40591 published to NVD
- 2026-04-22 - Last updated in NVD database
Technical Details for CVE-2026-40591
Vulnerability Analysis
This vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key, commonly known as an Insecure Direct Object Reference (IDOR). The core issue lies in the phone conversation creation endpoint's failure to validate that the requesting user has legitimate access to the customer record they are attempting to associate with a new conversation.
In FreeScout's multi-mailbox architecture, customers are typically scoped to specific mailboxes, and agents are granted permissions on a per-mailbox basis. This design assumes proper access control enforcement when agents interact with customer records. However, the vulnerable code path accepts user-supplied customer_id parameters without verifying that the target customer belongs to a mailbox the requesting agent has access to.
The attack allows an agent with minimal permissions (access to a single mailbox) to enumerate and bind conversations to customer records from any mailbox in the system. Additionally, the to_email parameter can be exploited to inject new alias email addresses into victim customer records, potentially enabling further attacks such as account takeover or phishing.
Root Cause
The root cause is insufficient authorization checking in the phone conversation creation backend logic. The application resolves target customer records based solely on the user-supplied customer_id parameter without enforcing mailbox-scoped visibility constraints. This architectural oversight allows cross-tenant data access in deployments where mailbox isolation is expected.
Attack Vector
The attack is network-based and requires low privileges—specifically, an authenticated agent account with permission to create phone conversations in at least one mailbox. No user interaction is required from the victim.
An attacker exploits this vulnerability by:
- Authenticating as a low-privileged agent with access to Mailbox A
- Initiating a phone conversation creation request
- Supplying a customer_id value belonging to a customer from Mailbox B (which the attacker should not have access to)
- Optionally including a to_email value to add a new alias to the victim customer record
- The backend processes the request without validating mailbox boundaries, successfully binding the conversation to the cross-mailbox customer
The vulnerability enables unauthorized read access to customer information and write access to modify customer email aliases across mailbox boundaries.
Detection Methods for CVE-2026-40591
Indicators of Compromise
- Phone conversation records associated with customers that do not belong to the conversation's mailbox
- Unexpected email aliases added to customer records, particularly those not matching typical communication patterns
- Audit logs showing conversation creation requests with customer_id values from different mailboxes than the target conversation
- Agent activity patterns showing access to customer records outside their assigned mailbox scope
Detection Strategies
- Implement database integrity checks to identify phone conversations where the customer's mailbox does not match the conversation's mailbox
- Review application logs for conversation creation requests where the customer_id references a different mailbox than the request context
- Monitor for bulk or automated requests to the phone conversation creation endpoint, which may indicate enumeration attempts
- Deploy web application firewall (WAF) rules to flag unusual parameter patterns in conversation creation requests
Monitoring Recommendations
- Enable detailed audit logging for all conversation creation events including customer associations
- Implement alerting on cross-mailbox customer-conversation bindings at the database level
- Monitor for agents creating conversations at unusually high rates or with diverse customer ID ranges
- Review customer record modifications, particularly email alias additions, for unauthorized changes
How to Mitigate CVE-2026-40591
Immediate Actions Required
- Upgrade FreeScout to version 1.8.214 or later immediately
- Audit existing phone conversation records for potential cross-mailbox customer associations
- Review customer records for unauthorized email alias additions
- Temporarily restrict phone conversation creation permissions to trusted agents until the patch is applied
Patch Information
FreeScout has addressed this vulnerability in version 1.8.214. The fix implements proper mailbox-scoped authorization checks in the phone conversation creation flow to ensure agents can only associate conversations with customers from mailboxes they have explicit access to.
The security patch is available through the following resources:
Workarounds
- Restrict phone conversation creation permissions to highly trusted agents only until the patch can be applied
- Implement network-level access controls to limit which users can reach the phone conversation creation endpoint
- Deploy a web application firewall (WAF) rule to validate that customer_id parameters in conversation creation requests correspond to the agent's authorized mailboxes
- Consider temporarily disabling the phone conversation feature if it is not critical to operations
# Update FreeScout to patched version
cd /path/to/freescout
git fetch origin
git checkout 1.8.214
php artisan freescout:after-app-update
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
