FreeScout Vulnerability Exposes Hidden Customer Data
The National Vulnerability Database has detailed CVE-2026-40589, a critical flaw in FreeScout, a self-hosted help desk solution. Prior to version 1.8.214, low-privileged agents could exploit this vulnerability by adding an email address owned by a hidden customer to a visible customer profile. This action inadvertently reveals the hidden customer’s name and profile URL, reassigns their email, and transfers associated conversations to the visible customer.
This vulnerability poses a significant risk for organizations using FreeScout, as it can lead to unauthorized access and exposure of sensitive customer information. The reassignment of emails and conversations could also disrupt operations and compromise data integrity. Defenders must prioritize updating their FreeScout instances to version 1.8.214 or later to mitigate this risk.
What This Means For You
- If your organization uses FreeScout, immediately update to version 1.8.214 or later. Audit your help desk environment for any signs of unauthorized email reassignment or access to hidden customer profiles.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
FreeScout Customer Data Disclosure via Email Reassignment - CVE-2026-40589
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-40589 | Vulnerability | CVE-2026-40589 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 21, 2026 at 20:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related Posts
CVE-2026-6744 — Bagisto Server-Side Request Forgery
CVE-2026-6744 — A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results...
Kyverno Policy Engine Flaw Leaks Service Account Tokens
CVE-2026-40868 — Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer...
Coturn ARM64 Crash: Unauthenticated DoS via Crafted STUN Message
CVE-2026-40613 — Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing functions in coturn perform...