FreeScout's change‑customer modal originally allowed the creation of new customers via a POST endpoint without enforcing unique‑email validation when the customer was marked as hidden. If an attacker supplies an email that is already used by a hidden customer, the create routine reuses the hidden customer object and populates empty profile fields with attacker‑controlled data. This permits arbitrary alteration of a hidden customer’s profile, potentially leaking sensitive information or facilitating impersonation. The weakness is CWE‑639, an authorization bypass that enables manipulation of data belonging to another user.

Any installation of FreeScout with a version earlier than 1.8.214 is affected. The flaw exists in the freescout‑help‑desk FreeScout application, particularly before the 1.8.214 release.

The CVSS score of 4.3 indicates a moderate risk, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploit activity. The EPSS score is not available, so the current probability of exploitation is unknown. An attacker would need to send a crafted POST request to the /customers/ajax endpoint, which may be restricted to users with permission to create customers or expose a hidden‑customer table. Thanks to the missing unique‑email check, the flaw can be leveraged to modify hidden customer records without additional privileges beyond the legitimate sender role.