CVE-2026-39384 FreeScout Customer Merge Cross-Mailbox Authorization Bypass
Attackers can bypass customer visibility restrictions during merge operations, potentially accessing or modifying data across mailboxes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39384?
CVE-2026-39384 is a high-severity missing authorization vulnerability in freescout-help-desk freescout, published on 7 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.
Weakness: CWE-639
Which versions are affected by CVE-2026-39384?
It affects 1 product.
Products include Freescout Freescout.
How do I fix CVE-2026-39384?
No fix has been published for CVE-2026-39384 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-39384 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39384 exists.
Other vulnerabilities in freescout-help-desk freescout
- CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
- CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover
- CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
- CVE-2024-29185 FreeScout OS Command Injection vulnerability
- CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
Sources
Also known as GHSA-j6v9-22vq-53vh.