CVE-2026-103984

Description

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.

References

• https://github.com/freescout-help-desk/freescout/commit/f0f8fd56253f1d7f42569ad30fb96375a473817a
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cr68-27qv-p5m4
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cr68-27qv-p5m4