CVE-2026-103984 · Other
NO FIX YET · SEE WHAT TO DO
FreeScout, a self-hosted help desk, lets a non-admin agent pull the rendered profile of a customer outside their access when limit_user_customer_visibility is enabled. The response can include contact details, postal address, social profiles and internal agent notes.
first public Aug 14, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only self-hosted FreeScout instances before 1.8.231 where limit_user_customer_visibility is enabled are exposed. Any agent account on such an instance can reach the flaw, so teams without that setting or on managed hosting can skip it.
Not affected if fixed-version-1.8.231-or-later, limit-user-customer-visibility-off
Who cares freescout, help-desk, self-hosted
unknown for the exact command, the sources do not say.limit_user_customer_visibility is enabled in the FreeScout configuration.1.8.231 or later.FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.