CVE-2026-62852 · Package
NO FIX YET · SEE WHAT TO DO
FreeScout, a self-hosted help desk, lets an authenticated user with assigned-only access subscribe to realtime channels for conversations they are not assigned to. Those event payloads can expose replies, internal notes, recipient addresses, assignee data and attachment download links.
first public Jul 15, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted FreeScout installations before 1.8.226 where some staff accounts are restricted to assigned conversations only. Any such user with a valid login can receive realtime data for other conversations in the same mailbox. Installations on managed hosting or with no restricted users are less exposed.
Not affected if managed-hosting, no-restricted-users
Who cares freescout, help-desk, php, self-hosted
1.8.226 or later.FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.