CVE-2026-40590: SSRF in FreeScout Help Desk Software

The SSRF vulnerability in FreeScout arises from insufficient validation within the /customers/ajax endpoint when creating new customers. Specifically, the endpoint lacks robust checks to ensure the provided email address is unique. An attacker can exploit this by supplying an email address already associated with a hidden (inactive or otherwise inaccessible) customer. This allows the attacker to reuse the existing customer object, effectively filling profile fields with attacker-controlled data. While the immediate impact might seem limited, this could lead to unauthorized access to sensitive customer information or manipulation of help desk workflows. The potential for data exfiltration or account takeover depends on the specific data stored within the customer profiles and the permissions associated with the reused account.

1. Reserved2026-04-14
2. Published2026-04-21
3. EPSS updated2026-04-29

The primary mitigation for CVE-2026-40590 is to immediately upgrade FreeScout to version 1.8.214 or later, which includes the necessary validation fixes. If upgrading is not immediately feasible due to compatibility concerns or downtime requirements, consider implementing a temporary workaround by restricting access to the /customers/ajax endpoint to trusted users only. Additionally, carefully review existing customer data for any suspicious or unexpected entries that might indicate prior exploitation. Monitor FreeScout logs for unusual activity related to customer creation or modification, paying close attention to requests originating from untrusted sources. There are no specific WAF rules or Sigma/YARA patterns readily available for this vulnerability, making proactive monitoring and prompt patching crucial.