The load_customer_info Ajax action in FreeScout fails to enforce the CustomerPolicy::view check when the limit_user_customer_visibility option is enabled. A non‑admin agent can supply any customer email and specify a mailbox that the agent is allowed to access, causing the system to return the full profile of an unrelated customer. The exposed data includes names, email addresses, phone numbers, company and job details, postal addresses, social media profiles, websites, and confidential internal agent notes, leading to a confidentiality breach of personally identifiable information.

The vulnerability affects the FreeScout help‑desk application provided by freescout-help-desk. Versions prior to 1.8.231 are impacted. Any deployment using the legacy prefix of the load_customer_info endpoint with limit_user_customer_visibility enabled is susceptible.

The CVSS base score of 6.5 indicates moderate severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the web application: an authenticated non‑admin agent can trigger the vulnerable Ajax request with arbitrary customer input. Successful exploitation requires the attacker to have user rights in FreeScout and to be able to supply a mailbox name that the agent can access; once these prerequisites are met, the attacker can glean sensitive customer information.