FreeScout exposes other users' notifications via SQL LIKE wildcards
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass, SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200, CWE-639 and CWE-89.
Summary
FreeScout before 1.8.226 is a self-hosted help desk and shared mailbox application. The polycast/receive endpoint does not escape SQL LIKE wildcards in channel names, and channel authorization only covers names with specific prefixes (CWE-89). An attacker with a guest session and a valid CSRF token can submit a wildcard channel name to retrieve notification events meant for other users, exposing conversation message content, identifiers, URLs and notification HTML across users and mailboxes.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. This issue is fixed in version 1.8.226.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| freescout-help-desk | freescout | before 1.8.226 | 1.8.226 | Patch available | CNA |
- freescout Vendorfreescout-help-desk Affected before 1.8.226 Fixed in 1.8.226 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* | — | — | freescout-help-desk |
- cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* Versions — — ·freescout-help-desk
Remediation
Upgrade FreeScout to version 1.8.226, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA freescout (freescout-help-desk) Fixed in 1.8.226
Timeline
- 2026-11-06 Threatist record created from CVE-2026-62856
- 2026-11-08 Priority changed: MEDIUM → LOW
References
Other 4
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj
- https://github.com/freescout-help-desk/freescout/commit/1f4deee6369d89a70d291248499883b5bfdb99ff
- https://github.com/freescout-help-desk/freescout/commit/656cb2349cd3bb11f04f01c1587900dfb423a855
- https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226
More freescout-help-desk vulnerabilities
- TI-2026-38652 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL CVSS 3.1CRITICAL 9.4
- TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
- TI-2026-30304 FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks CVSS 3.1CRITICAL 9.1
- TI-2026-29249 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVSS 4.0HIGH 8.9
- TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
- TI-2026-38648 FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails CVSS 3.1HIGH 8.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences