Cross-mailbox conversation existence disclosure in FreeScout search
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-639.
Summary
FreeScout before 1.8.226 does not apply the mailbox filter or view policy to the search-by-number shortcut in ConversationsController::search(). An authenticated non-admin agent who belongs to at least one mailbox can use a hash-prefixed ticket number to confirm that a conversation exists in another mailbox and learn its internal conversation and folder identifiers. The destination conversation stays protected, so message content, attachments and customer data are not disclosed. The weaknesses are CWE-200 and CWE-639.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in ConversationsController::search() resolves a user-controlled ticket number without applying the mailbox filter or view policy used by the normal search path. An authenticated non-admin agent who is a member of at least one mailbox can request /search with a hash-prefixed ticket number and use the 302 Location header to confirm that a conversation exists in a different mailbox the agent cannot access and learn its internal conversation and folder identifiers. The destination conversation remains protected, so this issue does not disclose message content, attachments, or customer data. This issue is fixed in version 1.8.226.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| freescout-help-desk | freescout | before 1.8.226 | 1.8.226 | Patch available | CNA |
- freescout Vendorfreescout-help-desk Affected before 1.8.226 Fixed in 1.8.226 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* | — | — | freescout-help-desk |
- cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* Versions — — ·freescout-help-desk
Remediation
Update FreeScout to version 1.8.226 or later, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA freescout (freescout-help-desk) Fixed in 1.8.226
Timeline
- 2026-11-06 Threatist record created from CVE-2026-62851
References
More freescout-help-desk vulnerabilities
- TI-2026-38652 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL CVSS 3.1CRITICAL 9.4
- TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
- TI-2026-30304 FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks CVSS 3.1CRITICAL 9.1
- TI-2026-29249 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVSS 4.0HIGH 8.9
- TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
- TI-2026-38648 FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails CVSS 3.1HIGH 8.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences