CVE-2026-62852Medium· 6.5▾ SunlitFreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversat…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.
freescout < 1.8.226Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-62851Medium· 4.3FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortcut (missing mailbox authorization)
CVE-2026-62856High· 7.7FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query
CVE-2026-103984Medium· 6.5FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII
CVE-2026-62854High· 7.6FreeScout: Stored XSS in mailbox signature via same-origin JS upload
CVE-2026-85744Medium· 5.4FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass
CVE-2026-62850Medium· 5.3FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets