CVE-2026-40591

FreeScout, a free self-hosted help desk and shared mailbox platform, contains a privilege escalation vulnerability (CVE-2026-40591) in versions prior to 1.8.214 affecting the phone-conversation creation workflow. The flaw allows low-privileged agents to manipulate customer visibility controls by injecting attacker-controlled parameters, enabling unauthorized access to hidden customers across different mailboxes and modification of customer records through email alias injection. The vulnerability has a CVSS score of 7.1 (HIGH) with a network attack vector, low complexity, and no user interaction required, resulting in confidentiality loss and high integrity impact. Exploitation requires low privileges but poses significant risk through cross-mailbox data exposure and unauthorized customer record modification. There is currently no evidence of active exploitation in the wild, no public exploit code availability, and the vulnerability remains inactive on threat tracking lists, though administrators should prioritize patching to version 1.8.214 or later.