---
id: "CVE-2026-62850"
page: "https://infrastack.ai/live/CVE-2026-62850"
kind: "vulnerability"
aliases: ["CVE-2026-62850"]
title: "FreeScout: maintenance endpoint leaks file paths and allows secret guessing"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["freescout", "package", "php", "self-hosted"]
not_affected_if: ["managed-hosting", "version-1.8.225-or-later"]
published_at: "2026-11-06T17:18:33+00:00"
first_seen_at: "2026-11-06T17:43:14+00:00"
updated_at: "2026-11-06T17:45:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62850", "first_seen_at": "2026-11-06T17:43:14+00:00"}]
exploit_sources: []
---

# FreeScout: maintenance endpoint leaks file paths and allows secret guessing

Link for people: https://infrastack.ai/live/CVE-2026-62850 (this .md is for agents)

FreeScout, a self-hosted help desk, exposes an administrative maintenance endpoint without proper access control. An attacker can learn which directories and files exist on the server and make unlimited guesses at the application key and database password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the FreeScout version: `1.8.225` or later is fixed; anything earlier is affected.
- Check whether the admin `tools.php` maintenance page is reachable from the internet without a login boundary.

## Fix

- FreeScout: upgrade to `1.8.225`

## Timeline

- 2026-11-06T17:43:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62850

## Documents

- [advisory] Vendor advisory: github.com https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j
- [fix] Patch: github.com https://github.com/freescout-help-desk/freescout/commit/8bb0594e95eab6661b4372e94ac02f62a6c3cb28
- [fix] Release notes: github.com https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225

## From the sources

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_