CVE-2026-40496

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable formula: `md5(APP_KEY + attachment_id + size)`. Since attachment_id is sequential and size can be brute-forced in a small range, an unauthenticated attacker can forge valid tokens and download any private attachment without credentials. Version 1.8.213 fixes the issue.

• CWE-330
• CWE-340

• https://github.com/freescout-help-desk/freescout/commit/dbdf8f2260b43a21818255c70f0b61b9de9cd555Patch
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213Release Notes
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2783-wxmm-wmwrExploit, Vendor Advisory

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40490The AsyncHttpClient (AHC) library allows Java applications t…6.8
• CVE-2026-40491gdown is a Google Drive public file/folder downloader. Versi…7.8
• CVE-2026-40492SAIL is a cross-platform library for loading and saving imag…9.8
• CVE-2026-40493SAIL is a cross-platform library for loading and saving imag…9.8
• CVE-2026-40494SAIL is a cross-platform library for loading and saving imag…9.8
• CVE-2026-40495FOSSBilling is a free, open-source billing and client manage…6.9
• CVE-2026-40497FreeScout is a free self-hosted help desk and shared mailbox…8.1
• CVE-2026-40498FreeScout is a free self-hosted help desk and shared mailbox…9.8
• CVE-2026-40499radare2 prior to version 6.1.4 contains a command injection …7.8
• CVE-2026-40500Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-40501Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit…8.8
• CVE-2026-40502OpenHarness prior to commit dd1d235 contains a command injec…8.8