CVE-2026-103984

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.231

Description When the limit user customer visibility setting is enabled, the load customer info AJAX action performs a global lookup using a customer email provided by the user and only verifies if the agent has access to a specified mailbox. This allows a non-admin agent to retrieve the rendered profile of an unrelated customer by specifying a mailbox they can access, bypassing the CustomerPolicy::view() check. The exposed data may include names, email addresses, phone numbers, company and job details, postal addresses, social profiles, websites, and confidential internal agent notes.

Recommendations Update to version 1.8.231.