CVE-2026-62852

MEDIUM 6.5

FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.

CWE	CWE-200 CWE-639 CWE-862
Vendor	freescout-help-desk
Product	freescout
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for freescout-help-desk freescout

Be the first to know when new medium vulnerabilities affecting freescout-help-desk freescout are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

freescout-help-desk / freescout

< 1.8.226

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w668-wq26-6c94 github.com: https://github.com/freescout-help-desk/freescout/commit/e47a54a5af6c57181ef99711326f5886e940b776 github.com: https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226