FreeScout, a PHP Laravel-based help desk application, did not properly enforce the limit_user_customer_visibility parameter during customer merge operations in versions before 1.8.212. This flaw allows an authorization bypass through user-controlled keys, classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability permits users with limited privileges to access or merge customer data beyond their authorized scope. The CVSS 3.1 score of 7.6 reflects a network attack vector with low attack complexity, requiring privileges but no user interaction, and impacts confidentiality, integrity, and availability to varying degrees. The vulnerability is resolved in FreeScout version 1.8.212.

Exploitation of this vulnerability can lead to unauthorized access to customer data by bypassing visibility restrictions, potentially compromising confidentiality and integrity of customer information. The impact includes limited availability disruption. There are no known exploits in the wild at this time.

Upgrade FreeScout to version 1.8.212 or later, where this vulnerability is fixed. Since no official patch links or vendor advisories are provided, users should verify the update from the official FreeScout source. Patch status is not yet confirmed beyond the version fix note, so checking the vendor advisory for current remediation guidance is recommended.