CVE-2026-40498: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in freescout-help-desk freescout
FreeScout versions prior to 1. 8. 213 contain a vulnerability where unauthenticated attackers can access administrative diagnostic and system tools. The /system/cron endpoint uses a static MD5 hash derived from the APP_KEY, which is exposed in responses and logs, leading to sensitive information disclosure including full server paths and process IDs. This exposure also enables resource exhaustion (DoS) attacks by allowing repeated triggering of heavy background tasks without rate limiting. Version 1. 8. 213 addresses and fixes this issue.
AI Analysis
Technical Summary
CVE-2026-40498 affects FreeScout help desk software versions before 1.8.213. An unauthenticated attacker can access restricted system and diagnostic endpoints, notably /system/cron, which relies on a static MD5 hash generated from the APP_KEY concatenated with 'web_cron_hash'. This hash is exposed in server responses and logs, making it accessible through GET requests in browser history and proxy logs. The vulnerability leads to exposure of sensitive server information such as full path disclosure and process IDs. Additionally, the lack of rate limiting on these endpoints allows attackers to repeatedly trigger resource-intensive background tasks, causing potential denial of service. The issue is fixed in version 1.8.213.
Potential Impact
The vulnerability allows unauthenticated attackers to gain access to sensitive server information that should be restricted, including full path disclosures and process IDs. This exposure can aid further attacks or reconnaissance. The static hash mechanism and its exposure increase the risk of unauthorized access. Furthermore, the absence of rate limiting enables attackers to perform resource exhaustion attacks, potentially causing denial of service by overloading server resources. There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
Upgrade FreeScout to version 1.8.213 or later, where this vulnerability is fixed. The vendor has addressed the issue in this release. Until upgrading, restrict access to the /system/cron endpoint and monitor for unusual activity if possible. Patch status is not explicitly stated in the vendor advisory, but the version update is the official fix.
CVE-2026-40498: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in freescout-help-desk freescout
Description
FreeScout versions prior to 1. 8. 213 contain a vulnerability where unauthenticated attackers can access administrative diagnostic and system tools. The /system/cron endpoint uses a static MD5 hash derived from the APP_KEY, which is exposed in responses and logs, leading to sensitive information disclosure including full server paths and process IDs. This exposure also enables resource exhaustion (DoS) attacks by allowing repeated triggering of heavy background tasks without rate limiting. Version 1. 8. 213 addresses and fixes this issue.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-40498 affects FreeScout help desk software versions before 1.8.213. An unauthenticated attacker can access restricted system and diagnostic endpoints, notably /system/cron, which relies on a static MD5 hash generated from the APP_KEY concatenated with 'web_cron_hash'. This hash is exposed in server responses and logs, making it accessible through GET requests in browser history and proxy logs. The vulnerability leads to exposure of sensitive server information such as full path disclosure and process IDs. Additionally, the lack of rate limiting on these endpoints allows attackers to repeatedly trigger resource-intensive background tasks, causing potential denial of service. The issue is fixed in version 1.8.213.
Potential Impact
The vulnerability allows unauthenticated attackers to gain access to sensitive server information that should be restricted, including full path disclosures and process IDs. This exposure can aid further attacks or reconnaissance. The static hash mechanism and its exposure increase the risk of unauthorized access. Furthermore, the absence of rate limiting enables attackers to perform resource exhaustion attacks, potentially causing denial of service by overloading server resources. There are no known exploits in the wild as of the publication date.
Mitigation Recommendations
Upgrade FreeScout to version 1.8.213 or later, where this vulnerability is fixed. The vendor has addressed the issue in this release. Until upgrading, restrict access to the /system/cron endpoint and monitor for unusual activity if possible. Patch status is not explicitly stated in the vendor advisory, but the version update is the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-13T19:50:42.115Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e7983919fe3cd2cddfb24b
Added to database: 4/21/2026, 3:31:05 PM
Last enriched: 4/21/2026, 3:46:06 PM
Last updated: 4/21/2026, 5:55:21 PM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.