CVE-2026-103984

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.

• CWE-862

• https://github.com/freescout-help-desk/freescout/commit/f0f8fd56253f1d7f42569ad30fb96375a473817a
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.231
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cr68-27qv-p5m4
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cr68-27qv-p5m4

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103965An issue in MongoDB Server's aggregation framework can cause…5.4
• CVE-2026-103966Adobe Framemaker is affected by a Heap-based Buffer Overflow…7.8
• CVE-2026-103967Adobe Framemaker is affected by an out-of-bounds write vulne…7.8
• CVE-2026-103974lichess.org is the forever free, adless and open source ches…5.4
• CVE-2026-103975Appium is a cross-platform automation framework for all kind…6.5
• CVE-2026-103977FileRise is a self-hosted web-based file manager with multi-…8.1
• CVE-2026-103985FreeScout is a self-hosted help desk and shared mailbox. Pri…7.1
• CVE-2026-103988FileRise is a self-hosted web-based file manager with multi-…5.4
• CVE-2026-103993An Out-of-bounds Write vulnerability in the routing protocol…6.8
• CVE-2026-103994A Heap-based Buffer Overflow vulnerability in the VXLAN Gate…8.8
• CVE-2026-103995Response body and chunk parsing would handle non-hex or nega…2
• CVE-2026-103996The If-So Dynamic Content – Elementor & All Page Builders Pe…6.4