Description

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility is enabled, the load_customer_info AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox. A non-admin agent can name an accessible mailbox and retrieve an unrelated customer's rendered profile without invoking CustomerPolicy::view(). The response can expose names, email addresses, phone numbers, company and job information, postal addresses, social profiles, websites, and confidential internal agent notes. This issue is fixed in version 1.8.231.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T17:17:10.710Z",
  "pubdate": "2026-11-06T17:17:10.710Z",
  "executiveSummary": "This vulnerability is an Improper Access Control flaw within FreeScout versions prior to 1.8.231, specifically impacting systems where the limit_user_customer_visibility configuration is enabled.\nThe vulnerability allows a non-administrative agent to bypass intended authorization checks to retrieve sensitive customer data that they should not have access to.\nBy manipulating the load_customer_info AJAX action, an authenticated attacker can perform global lookups on arbitrary customer email addresses.\nThe impact includes unauthorized exposure of Personally Identifiable Information (PII) and confidential internal communications, including names, phone numbers, postal addresses, social profiles, and sensitive internal agent notes.\nThis represents a significant risk to data privacy and regulatory compliance, as the security mechanism intended to restrict customer visibility is rendered ineffective.\nExploitation requires an authenticated attacker with standard agent-level access to the application, who then leverages the flawed API logic to request data from non-permitted mailboxes.",
  "technicalDetails": "The vulnerability originates from a flaw in the implementation of the load_customer_info AJAX action in FreeScout versions prior to 1.8.231. The root cause is a breakdown in the authorization logic when the limit_user_customer_visibility configuration setting is active.\nWhen this visibility restriction is enabled, the application is expected to enforce access control via the CustomerPolicy::view() method to ensure that agents only view customers associated with mailboxes they are authorized to access.\nHowever, the load_customer_info function performs a global lookup for a customer based on an attacker-provided email address. During this process, the application incorrectly validates access by checking only the visibility of a mailbox supplied in the request, rather than verifying the agent's actual permissions against the target customer's profile.\nBecause the logic fails to invoke the mandatory CustomerPolicy::view() authorization check, a non-admin agent can circumvent the platform's security controls. The attack flow is as follows: 1) The attacker authenticates as a standard agent. 2) The attacker crafts an AJAX request to the load_customer_info endpoint. 3) The attacker injects an arbitrary customer email address into the request payload. 4) The attacker provides the ID of a mailbox they have legitimate access to as a bypass parameter. 5) The server-side logic validates the agent's access to the provided mailbox and, erroneously, returns the rendered profile of the unrelated target customer.\nThe response payload includes sensitive PII, such as customer names, email addresses, phone numbers, postal addresses, job titles, company information, and social media URLs. Critically, it also discloses internal agent notes which may contain confidential discussions regarding the customer. This enables an attacker to perform unauthorized reconnaissance or data exfiltration across the platform's user base, effectively breaking the multi-tenancy or visibility constraints enforced by the application's configuration. The vulnerability is present in the application's backend controller logic responsible for processing AJAX customer data retrieval, persisting until the patch in version 1.8.231."
}