FreeScout, a self-hosted help desk and shared mailbox software, contains an authorization bypass vulnerability (CWE-639, CWE-862) in versions before 1.8.213. Specifically, the `load_customer_info` action in the `POST /conversation/ajax` endpoint does not properly verify whether an authenticated user has access to the mailbox associated with the requested customer data. This allows any authenticated user who knows a valid email address to retrieve the full customer profile, including sensitive PII. The vulnerability has a CVSS 4.0 base score of 5.7 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. The issue is resolved in FreeScout version 1.8.213.

An attacker who is authenticated to the FreeScout system but lacks proper mailbox access can retrieve complete customer profile data, including sensitive personally identifiable information, by exploiting this vulnerability. This leads to unauthorized disclosure of customer data, violating confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Upgrade FreeScout to version 1.8.213 or later, where this authorization bypass vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in this version, applying this official fix is the recommended remediation. No other mitigation or temporary workaround is documented.