CVE-2026-39384 HIGH

CVE-2026-39384: FreeScout Customer Merge Cross-Mailbox Authorization Bypass

Vendor Freescout-Help-Desk
Product freescout
Weakness CWE-639 · IDOR
Published April 7, 2026
Last update April 9, 2026
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.

Key dates

02Disclosure timeline

April 7, 2026 CVE published
April 9, 2026 Record updated