---
id: CVE-2026-62852
title: >-
  FreeScout: Missing Authorization and Exposure of Sensitive Information to an
  Unauthorized Actor and Authorization Bypass Through User-Controlled Key
summary: >-
  FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226,
  RealtimeConvNewThread checks only general mailbox access and does not apply
  the conversation-level restriction for users configured to see only assigned
  conversat…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
  - CWE-639
  - CWE-862
vendor: freescout-help-desk
product: freescout
affected:
  - freescout < 1.8.226
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:03:33.062Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62852'
references:
  - url: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w668-wq26-6c94
    label: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w668-wq26-6c94
  - url: >-
      https://github.com/freescout-help-desk/freescout/commit/e47a54a5af6c57181ef99711326f5886e940b776
    label: >-
      https://github.com/freescout-help-desk/freescout/commit/e47a54a5af6c57181ef99711326f5886e940b776
  - url: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226'
    label: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226'
tags:
  - cve.org
ingestedAt: '2026-11-06T18:00:12.573Z'
epss: 0.00231
epssPercentile: 0.13977
---

## Overview

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.

## Affected

- `freescout < 1.8.226`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.