CVE-2026-85744Medium· 5.4▾ SunlitFreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-con…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target's existing contents. This issue is fixed in version 1.8.227.
freescout < 1.8.227Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-62854High· 7.6FreeScout: Stored XSS in mailbox signature via same-origin JS upload
CVE-2026-62851Medium· 4.3FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortcut (missing mailbox authorization)
CVE-2026-62856High· 7.7FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query
CVE-2026-62852Medium· 6.5FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key
CVE-2026-62850Medium· 5.3FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets
CVE-2026-85743High· 8.2FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks