Secuno
ENNL
Book demo

CVE-2026-40498

Freescout broken access control

9.8 CRITICALPublic exploitEPSS 0.73%
  1. Published21 Apr 2026

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP_KEY, which is exposed in the response and logs. Accessing these endpoints reveals sensitive server information (Full Path Disclosure), process IDs, and allows for Resource Exhaustion (DoS) by triggering heavy background tasks repeatedly without any rate limiting. The cron hash is generated using md5(APP_KEY . 'web_cron_hash'). Since this hash is often transmitted via GET requests, it is susceptible to exposure in server logs, browser history, and proxy logs. Furthermore, the lack of rate limiting on these endpoints allows for automated resource exhaustion (DoS) and brute-force attempts. Version 1.8.213 fixes the issue.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Freescout< 1.8.213

Remediation

Fixed in
Freescout≥ 1.8.213

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-938928.1
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated…
CVE-2026-821039.6
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker…
CVE-2026-1078118.8
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0,…
CVE-2026-839438.7
Exposure of sensitive information to an unauthorized actor in Azure API Center allows…
CVE-2026-1075109.1
An authenticated high privilege user can inject arguments in troubleshooting commands…
CVE-2026-764989.8
As part of Cisco's ongoing commitment to proactive security and product quality, the…

Frequently asked

Is CVE-2026-40498 being actively exploited?

CVE-2026-40498 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.73%.

How severe is CVE-2026-40498?

CVE-2026-40498 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.73% probability of exploitation.

Which products are affected by CVE-2026-40498?

Affected products include Freescout.

How do I fix CVE-2026-40498?

Upgrade affected software to a fixed version, for example Freescout 1.8.213 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-40498 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.