HarborGuard / CVE
Back to search
HIGHCVE-2026-39384Published Modified CNA GitHub_M

CVE-2026-39384: FreeScout Customer Merge Cross-Mailbox Authorization Bypass

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.

Metrics

CVSS v3.1
7.6
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • freescout-help-desk / freescout
    < 1.8.212
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
References