CVE-2026-40498
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-200
Revelación de información
Fecha de publicación:
21/04/2026
Última modificación:
22/04/2026
Descripción
*** Pendiente de traducción *** FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP_KEY, which is exposed in the response and logs. Accessing these endpoints reveals sensitive server information (Full Path Disclosure), process IDs, and allows for Resource Exhaustion (DoS) by triggering heavy background tasks repeatedly without any rate limiting. The cron hash is generated using md5(APP_KEY . 'web_cron_hash'). Since this hash is often transmitted via GET requests, it is susceptible to exposure in server logs, browser history, and proxy logs. Furthermore, the lack of rate limiting on these endpoints allows for automated resource exhaustion (DoS) and brute-force attempts. Version 1.8.213 fixes the issue.
Impacto
Puntuación base 4.0
8.90
Gravedad 4.0
ALTA
Puntuación base 3.x
9.80
Gravedad 3.x
CRÍTICA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* | 1.8.213 (excluyendo) |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- https://github.com/freescout-help-desk/freescout/commit/b1d6c2c601a6ec3626ab13e679607b5084dfbd38
- https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5jw5-q9j7-4rxc
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5jw5-q9j7-4rxc