CVE-2026-40589 is an authorization bypass vulnerability in FreeScout (a self-hosted help desk and shared mailbox software) affecting versions prior to 1.8.214. A low-privileged agent can exploit this by editing a visible customer and adding an email address that belongs to a hidden customer in a different mailbox. This results in the server disclosing the hidden customer's identity and profile URL in a success message, reassigning the hidden email to the visible customer, and rebinding conversations from the hidden mailbox to the visible customer. This behavior violates proper authorization controls and data isolation between customers. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

The vulnerability allows a low-privileged user to access and manipulate data associated with hidden customers, including disclosure of their names and profile URLs and reassignment of their email addresses and conversations. This can lead to unauthorized data exposure and integrity issues within the help desk system. The CVSS score of 7.6 (high severity) reflects the network attack vector, low attack complexity, and significant impact on confidentiality and integrity.

Upgrade FreeScout to version 1.8.214 or later, where this vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the version information in the description. No additional mitigation steps are indicated.