CVE-2026-40496 is a critical flaw in the FreeScout help desk, scored CVSS 9.1. Attachment download tokens are built from a predictable formula, so an unauthenticated attacker can forge them and download private attachments. FreeScout 1.8.213 fixes it. Upgrade and rotate the application key.
What's affected
- Affected: FreeScout before 1.8.213
- Fixed: 1.8.213
The advisory describes the token as an MD5 hash of the application key, the attachment id and the size. The attachment id is sequential and the size can be tried within a small range. The same release fixes CVE-2026-40498, covered in a companion guide.
How to check if you're exposed
Find your FreeScout version in the admin interface footer, or from the install directory:
grep -rn "version" config/app.php
If your version is below 1.8.213, you are affected. Check the web server logs for large numbers of attachment download requests with varying values from a single address.
What to do now
- Upgrade FreeScout to 1.8.213.
- Consider rotating the APP_KEY after upgrading, since the weak formula depended on it. Plan this carefully because it can invalidate sessions and encrypted values.
- Review attachment access logs for bulk downloads.
- Assess which private attachments might have been exposed and whether notice duties apply to you.
Why it matters
The weaknesses are CWE-330, use of insufficiently random values, and CWE-340, generation of predictable numbers. A token meant to prove permission was derived from guessable parts and a secret, and the secret is only one factor if everything else is predictable and testable.
The standard fix is a random token stored server side, or a keyed signature, such as an HMAC, with an expiry. Help desks hold customer messages and files, which raises the cost of a leak. The record does not report exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to rotate the key?
The advisory does not say so. It is a reasonable precaution since the formula used it, but test the effect on sessions first.
Sources
Last reviewed: 19 October 2026.
