Read the docs
TI-2026-29249 Aliases CVE-2026-40498

FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron

Priority HIGH 80CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass, Denial of service
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200, CWE-284 and CWE-770.

Summary

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP_KEY, which is exposed in the response and logs. Accessing these endpoints reveals sensitive server information (Full Path Disclosure), process IDs, and allows for Resource Exhaustion (DoS) by triggering heavy background tasks repeatedly without any rate limiting. The cron hash is generated using md5(APP_KEY . 'web_cron_hash'). Since this hash is often transmitted via GET requests, it is susceptible to exposure in server logs, browser history, and proxy logs. Furthermore, the lack of rate limiting on these endpoints allows for automated resource exhaustion (DoS) and brute-force attempts. Version 1.8.213 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00571 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed freescout (freescout-help-desk): 1.8.213

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
freescout-help-deskfreescoutbefore 1.8.2131.8.213Patch availableCNA
  • freescout Vendorfreescout-help-desk Affected before 1.8.213 Fixed in 1.8.213 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*before 1.8.213Vulnerablefreescout-help-desk
  • cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* Versions before 1.8.213 Vulnerable ·freescout-help-desk

Remediation

  • Fix · CNA freescout (freescout-help-desk) Fixed in 1.8.213

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40498
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 1

Other 1

  • TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
  • TI-2026-25245 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) CVSS 3.1CRITICAL 9.3
  • TI-2026-22596 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2024-19354 FreeScout OS Command Injection vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2026-22018 FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache CVSS 3.1HIGH 8.8
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences