FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…escout/security/advisories/GHSA-cr68-27qv-p5m4 Diğer
• github.com/…ommit/f0f8fd56253f1d7f42569ad30fb96375a473817a Diğer
• github.com/…scout-help-desk/freescout/releases/tag/1.8.231 Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:07Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-85742FreeScout: Conditional stored admin XSS via failed-job details
• 7,1 CVE-2026-103985FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save
• 8,2 CVE-2026-85743FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks
• 5,4 CVE-2026-85744FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass
• 5,3 CVE-2026-62850FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration a…
• 6,5 CVE-2026-62852FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key