Skip to content
OpenAdvisories
High · 7.6 CVE-2026-39384 EUVD-2026-19740

FreeScout Customer Merge Cross-Mailbox Authorization Bypass

Published Apr 7, 2026 · Updated Apr 9, 2026 · Assigned by GitHub_M

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.

Affected products

VendorProductAffectedFixed
freescout-help-desk freescout < 1.8.212 —

References