FreeScout versions before 1.8.212 have a flaw that ignores the limit_user_customer_visibility setting when merging customer records. This causes the merge operation to combine data across mailboxes, allowing a user who merges customers to potentially view or edit information belonging to other mailboxes. The bug represents a misuse of access control (CWE‑639) and results in an unauthorized elevation of privileges.

Any installation of FreeScout built on PHP’s Laravel framework with a version preceding 1.8.212 is vulnerable. The issue was identified by the maintainers and addressed in the 1.8.212 release.

The CVSS score of 7.6 indicates a high severity level. Although EPSS data is not available, the vulnerability is not yet listed in any known exploited vulnerability catalog, suggesting that it may not yet be widely attacked. An attacker would typically need legitimate access to the merge function, either via the web interface or an API, and would exploit the flaw by selecting customers from different mailboxes to perform a merge. The impact is direct escalation of privileges, potentially exposing sensitive customer information. Mitigation is to apply the vendor‑provided patch or upgrade to a non‑vulnerable version.