CVE-2026-40498 - Vulnerability Analysis

Overview

FreeScout < 1.8.213 contains an information disclosure and denial of service vulnerability caused by exposure of a static MD5 hash derived from APP_KEY in /system/cron endpoint, letting unauthenticated attackers access sensitive system info and trigger resource exhaustion, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can access sensitive system information and cause denial of service by exhausting server resources.

Mitigation

Upgrade to version 1.8.213 or later.

References

• https://github.com/freescout-help-desk/freescout/commit/b1d6c2c601a6ec3626ab13e679607b5084dfbd38
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-5jw5-q9j7-4rxc

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner