The vulnerability is due to a missing authorization check in the load_customer_info action of the /conversation/ajax endpoint. An authenticated user can supply any email address and retrieve the full customer profile, exposing personal identifying information. The weakness, categorized as CWE‑639 and CWE‑862, compromises confidentiality of customer data and can lead to privacy breaches or regulatory non‑compliance.

The flaw affects installations of FreeScout Help Desk version 1.8.212 and earlier. Users deploying the open‑source software before the 1.8.213 release are susceptible. The vendor's advisory lists the problem and specifies that upgrade to 1.8.213 or later resolves the issue.

The CVSS base score of 5.7 indicates a moderate impact. The EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that it is not actively exploited. Exploitation requires only an authenticated session, typically a normal user account, and knowledge of the target email address. An attacker could craft a POST request bearing the load_customer_info action and observe the returned PII, therefore the primary risk is confidential data compromise. Since no remote code execution or denial of service is implied, the immediate threat is data confidentiality loss.