CVE-2026-40570 MEDIUM

CVE-2026-40570: FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII

Vendor Freescout-Help-Desk

Product freescout

Weakness CWE-639 · IDOR

Published April 21, 2026

Last update April 21, 2026

View on NVD All CVEs

CVSS base score

5.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` returns complete customer profile data to any authenticated user without verifying mailbox access. An attacker only needs a valid email address to retrieve all customer PII. Version 1.8.213 fixes the issue.

Key dates

02Disclosure timeline

April 21, 2026 CVE published

April 21, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-40570 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

CVE-2026-40570: FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII

01Description

02Disclosure timeline

03References

04Related CVE