Auth bypass in Freescout-Help-Desk Freescout

CVE-2026-62852

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.

Vulnerability class: Information Disclosure

Published .

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-62852?
CVE-2026-62852 is a medium-severity vulnerability in Freescout-Help-Desk Freescout, classified under Information Disclosure. CVSS score: 6.5/10. Published 2026-11-06.
How severe is CVE-2026-62852?
Medium severity. CVSS v3 base score is 6.5 out of 10.