FreeScout's Customer AJAX Create Modifies Hidden Existing Customer

The SSRF vulnerability in FreeScout arises from insufficient validation within the /customers/ajax endpoint when creating new customers. Specifically, the endpoint lacks robust checks to ensure the provided email address is unique. An attacker can exploit this by supplying an email address already associated with a hidden (inactive or otherwise inaccessible) customer. This allows the attacker to reuse the existing customer object, effectively filling profile fields with attacker-controlled data. While the immediate impact might seem limited, this could lead to unauthorized access to sensitive customer information or manipulation of help desk workflows. The potential for data exfiltration or account takeover depends on the specific data stored within the customer profiles and the permissions associated with the reused account.

Organizations utilizing FreeScout for help desk and shared mailbox management are at risk, particularly those running versions 1.0.0 through 1.8.213. Shared hosting environments where multiple FreeScout instances reside on the same server are also at increased risk, as a compromise of one instance could potentially impact others. Any deployment relying on the default configuration without additional security hardening measures is potentially vulnerable.

• php: Examine FreeScout application logs for POST requests to /customers/ajax with action=create and unusual or unexpected data in the request body.

grep 'POST /customers/ajax action=create' /var/log/apache2/access.log

• generic web: Use curl to test the /customers/ajax endpoint with a known existing email address to see if a hidden customer object is reused.

curl -X POST -d 'name=Test&[email protected]&action=create' http://your-freescout-instance/customers/ajax

• generic web: Check FreeScout configuration files for any unusual or unexpected settings related to customer creation or email validation.

1. 2026-04-21Disclosure

   disclosure

1. Réservé2026-04-14
2. Publiée2026-04-21
3. EPSS mis à jour2026-04-29

The primary mitigation for CVE-2026-40590 is to immediately upgrade FreeScout to version 1.8.214 or later, which includes the necessary validation fixes. If upgrading is not immediately feasible due to compatibility concerns or downtime requirements, consider implementing a temporary workaround by restricting access to the /customers/ajax endpoint to trusted users only. Additionally, carefully review existing customer data for any suspicious or unexpected entries that might indicate prior exploitation. Monitor FreeScout logs for unusual activity related to customer creation or modification, paying close attention to requests originating from untrusted sources. There are no specific WAF rules or Sigma/YARA patterns readily available for this vulnerability, making proactive monitoring and prompt patching crucial.