CVE-2026-40498 is a critical access control flaw in the FreeScout help desk, scored CVSS 9.8. The /system/cron endpoint relies on a static hash derived from the application key, so an unauthenticated visitor can reach admin diagnostics. FreeScout 1.8.213 fixes it.
What's affected
- Affected: FreeScout before 1.8.213
- Fixed: 1.8.213
The advisory says the cron hash is an MD5 of the application key and a fixed string, it appears in responses and logs, and it often travels in GET requests. It lists effects as full path disclosure, process id disclosure and resource exhaustion by triggering heavy background tasks repeatedly with no rate limit.
How to check if you're exposed
Check the FreeScout version in the admin footer and compare it with 1.8.213. Then search your web server and proxy logs for the cron path:
grep -r "system/cron" /var/log/nginx /var/log/apache2 2>/dev/null | head
Look at where the cron URL is configured. If you call it from an external scheduler, the hash sits in that job definition and in access logs.
What to do now
- Upgrade to FreeScout 1.8.213.
- Prefer running the scheduled task through the command line scheduler on the host, and not through a URL that carries a hash.
- Remove the hash from shared logs and monitoring dashboards.
- Add rate limiting at your proxy for system paths.
- Consider rotating the application key after upgrade, testing the effect first.
Why it matters
The record lists CWE-200, exposure of sensitive information, CWE-284, improper access control, and CWE-770, allocation of resources without limits. The common thread is a secret placed in a URL. URLs end up in browser history, proxy logs and referrer headers, so they make poor places for a long lived secret.
The score of 9.8 is driven by access with no login; the listed effects in the advisory are information disclosure and denial of service. The record does not flag exploitation in the wild.
Quick check
Is this the same issue as CVE-2026-40496?
No. That one is about forged attachment tokens. Both are fixed in 1.8.213.
Sources
Last reviewed: 19 October 2026.
