User-Created Ticket Number Bypass in FreeScout Help Desk Software

CVE-2026-62851

What is CVE-2026-62851?

In FreeScout, a self-hosted help desk solution, an authorization bypass vulnerability exists in the ConversationsController's search functionality prior to version 1.8.226. This flaw allows an authenticated non-admin user, who is part of at least one mailbox, to conduct searches using a user-controlled ticket number without applying the necessary mailbox filter or view policy. As a result, these agents can confirm the existence of conversations housed within mailboxes they are not authorized to access, revealing internal identifiers associated with those conversations. It is important to note that this issue does not expose message content, attachments, or customer data, but it can lead to potential unauthorized insights into mailbox structures. The issue has been addressed in the latest version, enhancing the security posture of FreeScout.

References