CVE-2026-40496

CVE-2026-40496 affects FreeScout versions prior to 1.8.213, a self-hosted help desk and shared mailbox platform. The vulnerability stems from weak token generation for attachment downloads using a predictable MD5 formula based on the application key, sequential attachment ID, and file size. This allows unauthenticated attackers to forge valid download tokens and access private attachments without authentication. The attack vector is network-based and requires no user interaction or authentication, making it accessible to remote adversaries. Attack complexity is low due to the predictable nature of attachment IDs and the limited range of file sizes that can be brute-forced. Successful exploitation could result in unauthorized disclosure of sensitive information contained in private attachments, potentially exposing confidential business or customer data. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. With a FAUCET risk score of 51.0/100 and minimal EPSS score, community attention and exploit code availability appear limited. The vendor has released a fix in version 1.8.213, and organizations should prioritize patching to remediate this exposure.