---
id: CVE-2026-62851
title: >-
  FreeScout: Cross-mailbox conversation existence / internal-id disclosure via
  the search-by-number (`#`) shortcut (missing mailbox authorization)
summary: >-
  FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the
  search-by-number shortcut in ConversationsController::search() resolves a
  user-controlled ticket number without applying the mailbox filter or view
  policy use…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
  - CWE-639
vendor: freescout-help-desk
product: freescout
affected:
  - freescout < 1.8.226
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:01:44.196Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62851'
references:
  - url: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wqq7-4q7m-273v
    label: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wqq7-4q7m-273v
  - url: >-
      https://github.com/freescout-help-desk/freescout/commit/4e197d8ce97eb6610ef71402d8c2512824a9a1b5
    label: >-
      https://github.com/freescout-help-desk/freescout/commit/4e197d8ce97eb6610ef71402d8c2512824a9a1b5
  - url: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226'
    label: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226'
tags:
  - cve.org
ingestedAt: '2026-11-06T18:00:12.577Z'
epss: 0.00193
epssPercentile: 0.09005
---

## Overview

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in ConversationsController::search() resolves a user-controlled ticket number without applying the mailbox filter or view policy used by the normal search path. An authenticated non-admin agent who is a member of at least one mailbox can request /search with a hash-prefixed ticket number and use the 302 Location header to confirm that a conversation exists in a different mailbox the agent cannot access and learn its internal conversation and folder identifiers. The destination conversation remains protected, so this issue does not disclose message content, attachments, or customer data. This issue is fixed in version 1.8.226.

## Affected

- `freescout < 1.8.226`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.