CVE-2026-40496 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force

What is CVE-2026-40496?

CVE-2026-40496 is a high-severity vulnerability in freescout-help-desk freescout, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable formula: `md5(APP_KEY + attachment_id + size)`. Since attachment_id is sequential and size can be brute-forced in a small range, an unauthenticated attacker can forge valid tokens and download any private attachment without credentials. Version 1.8.213 fixes the issue.

Weakness: CWE-340, CWE-330

Which versions are affected by CVE-2026-40496?

It affects 1 product.

Products include Freescout Freescout.

How do I fix CVE-2026-40496?

No fix has been published for CVE-2026-40496 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-40496 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40496 exists.

Other vulnerabilities in freescout-help-desk freescout

• CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution Critical 10.0
• CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover Critical 9.8
• CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) Critical 9.3
• CVE-2024-29185 FreeScout OS Command Injection vulnerability Critical 9.1
• CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron High 8.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2783-wxmm-wmwr.