FreeScout has Customer Edit Cross-Mailbox Email Takeover
wird übersetzt…Plattform
php
Komponente
freescout-help-desk
Behoben in
1.8.215
CVE-2026-40589 affects FreeScout help desk systems prior to version 1.8.214. This vulnerability allows a low-privileged agent to manipulate customer profiles and email addresses, leading to potential data exposure and email spoofing. The vulnerability was published on April 21, 2026, and a patch is available in version 1.8.214.
Auswirkungen und Angriffsszenarienwird übersetzt…
An attacker exploiting this vulnerability could impersonate a customer by associating an email address with a visible customer profile while it originally belonged to a hidden one. This allows the attacker to view the hidden customer's profile information, including their name and profile URL, which could be used for social engineering or further attacks. Furthermore, the attacker can rebind conversations associated with the email address to the visible customer, potentially gaining access to sensitive information or manipulating communication history. The blast radius extends to all customers whose email addresses are managed within the FreeScout system.
Ausnutzungskontextwird übersetzt…
The vulnerability is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation. Public proof-of-concept (POC) code is not currently available. Given the nature of the vulnerability (email spoofing and data exposure), it is reasonable to expect that it could be targeted by malicious actors, especially if a readily exploitable POC is released. Refer to the official FreeScout advisory for further details.
Bedrohungsanalyse
Exploit-Status
EPSS
0.04% (11% Perzentil)
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Niedrig — jedes gültige Benutzerkonto ist ausreichend.
- User Interaction
- Keine — automatischer und lautloser Angriff. Das Opfer tut nichts.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Niedrig — partieller oder indirekter Zugriff auf einige Daten.
- Integrity
- Hoch — Angreifer kann beliebige Daten schreiben, ändern oder löschen.
- Availability
- Niedrig — partieller oder intermittierender Denial of Service.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserviert
- Veröffentlicht
- EPSS aktualisiert
Mitigation und Workaroundswird übersetzt…
The primary mitigation for CVE-2026-40589 is to immediately upgrade FreeScout to version 1.8.214 or later. If upgrading is not immediately feasible, consider implementing strict access controls to limit the privileges of agents within the FreeScout system. Review agent activity logs for any suspicious modifications to customer profiles or email addresses. While a WAF cannot directly prevent this vulnerability, it could be configured to flag unusual patterns of email address modifications. After upgrading, confirm the fix by attempting to create a new customer and associating an existing email address with them; the operation should fail.
So behebenwird übersetzt…
Actualice FreeScout a la versión 1.8.214 o posterior para mitigar la vulnerabilidad. Esta actualización corrige un problema que permite a un agente de bajo privilegio editar un cliente visible y agregar una dirección de correo electrónico perteneciente a otro cliente oculto, lo que podría resultar en la toma de control de la cuenta de correo electrónico.
CVE-Sicherheitsnewsletter
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
Häufig gestellte Fragenwird übersetzt…
What is CVE-2026-40589 — Email Spoofing in FreeScout?
CVE-2026-40589 is a HIGH severity vulnerability in FreeScout versions 1.0.0 through 1.8.213 that allows a low-privileged agent to link email addresses to different customer profiles, potentially enabling email spoofing and data exposure.
Am I affected by CVE-2026-40589 in FreeScout?
You are affected if you are running FreeScout version 1.0.0 through 1.8.213. Verify your FreeScout version and upgrade immediately if vulnerable.
How do I fix CVE-2026-40589 in FreeScout?
Upgrade FreeScout to version 1.8.214 or later. If immediate upgrade is not possible, implement strict access controls for agents and monitor activity logs.
Is CVE-2026-40589 being actively exploited?
There is no current evidence of active exploitation, but the vulnerability's nature suggests it could be targeted. Monitor security advisories and threat intelligence feeds.
Where can I find the official FreeScout advisory for CVE-2026-40589?
Refer to the official FreeScout security advisory, which can be found on the FreeScout website or through their security mailing list. (Link to advisory would be here if available).
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.