Unauthenticated Attachment Download Vulnerability in FreeScout Help Desk by FreeScout
CVE-2026-48812

7.5HIGH

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
20 July 2026

What is CVE-2026-48812?

FreeScout, a free help desk and shared inbox solution built on the PHP Laravel framework, has a vulnerability where its attachment download mechanism fails to enforce token authentication for attachments with a specific token type, namely TOKEN_TYPE_LEGACY. This lack of authentication allows remote attackers to access any file created by earlier versions of FreeScout without needing valid credentials. The issue has been addressed in version 1.8.221, which implements necessary authentication measures to secure attachment downloads appropriately.

Affected Version(s)

freescout < 1.8.221

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/commit/2...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.