Access Control Bypass Vulnerability in FreeScout Help Desk Software
CVE-2026-62852

6.5MEDIUM

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
6 November 2026

What is CVE-2026-62852?

FreeScout, a self-hosted help desk and shared mailbox solution, has a vulnerability that allows restricted authenticated users to access information beyond their permissions. Specifically, the RealtimeConvNewThread feature lacks adequate checks on conversation-level access, enabling these users to subscribe to channels tied to other conversations within the same mailbox. As a consequence, sensitive data—such as complete replies, internal notes, recipient addresses, conversation states, assignee information, attachment names, and URLs containing valid download tokens—can be inadvertently exposed. This issue has been resolved in version 1.8.226.

Affected Version(s)

freescout < 1.8.226

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/commit/e...
x_refsource_MISC
https://github.com/freescout-help-desk/freescout/releases...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.