High severity7.6NVD Advisory· Published Apr 7, 2026· Updated Apr 24, 2026

CVE-2026-39384

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility parameter into account when merging customers. This vulnerability is fixed in 1.8.212.

Affected products

Freescout/Freescout
cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*
Range: <1.8.212

Patches

b395a1179117

https://github.com/freescout-help-desk/freescoutvia nvd-ref

commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/freescout-help-desk/freescout/commit/b395a1179117af5e2df704c6bad71feeb301b4cenvdPatch
github.com/freescout-help-desk/freescout/security/advisories/GHSA-j6v9-22vq-53vhnvdExploitVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.494
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000