CVE-2026-103984
Received Received - Intake

Information Disclosure in FreeScout Help Desk

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: GitHub, Inc.

Description
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-103984
EUVD
EUVD-2026-118378

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freescout freescout 1.8.231

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeScout is a self-hosted help desk tool. This vulnerability exists in versions before 1.8.231 when the 'limit_user_customer_visibility' feature is enabled. A non-admin agent can exploit the load_customer_info AJAX action by providing a mailbox they can access and a target customer's email. This bypasses visibility controls and retrieves sensitive customer data like names, emails, phone numbers, addresses, and internal notes without proper authorization.

Impact Analysis

If exploited, this vulnerability allows unauthorized access to sensitive customer personally identifiable information (PII) such as names, contact details, company information, and confidential internal notes. Attackers with low privileges could view data they should not have access to, potentially leading to data breaches, privacy violations, and reputational damage for organizations using affected FreeScout versions.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data protection and access controls. It enables unauthorized access to sensitive customer data, which could result in non-compliance with privacy regulations, potential fines, and legal consequences. Organizations must ensure proper access controls are in place to meet regulatory standards.

Mitigation Strategies

Upgrade FreeScout to version 1.8.231 or later to apply the security fix addressing the customer visibility bypass in the load_customer_info AJAX action.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...