Authentication Bypass Vulnerability in FreeScout Help Desk Software
CVE-2026-62850

5.3MEDIUM

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
6 November 2026

What is CVE-2026-62850?

FreeScout, a self-hosted help desk solution, has a vulnerability prior to version 1.8.225 that compromises the administrative tools.php maintenance endpoint, allowing unauthorized access. Attackers can exploit this vulnerability to validate the existence of files and directories on the server through response differences, revealing sensitive information. Additionally, the endpoint lacks protection mechanisms such as rate limiting and CAPTCHA, allowing an attacker to perform unlimited guessing attempts against application secrets like the application key and database password. This issue has been addressed in version 1.8.225.

Affected Version(s)

freescout < 1.8.225

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/commit/8...
x_refsource_MISC
https://github.com/freescout-help-desk/freescout/releases...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.