{"id":"CVE-2026-62852","kind":"vulnerability","aliases":["CVE-2026-62852"],"related":[],"title":"FreeScout: restricted agents can read other conversations' replies and notes","description":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.","summary":"FreeScout, a self-hosted help desk, lets an authenticated user with assigned-only access subscribe to realtime channels for conversations they are not assigned to. Those event payloads can expose replies, internal notes, recipient addresses, assignee data and attachment download links.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freescout","help-desk","package","php","self-hosted"],"not_affected_if":["managed-hosting","no-restricted-users"],"how_to_check":"- Check the installed FreeScout version and compare it with the fixed release listed in the sources.\n- Review which staff accounts are set to see only assigned conversations.","fix":"- Upgrade FreeScout to `1.8.226` or later.","status":"open","published_at":"2026-11-06T17:18:33+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","triaged_at":"2026-11-06T17:45:15+00:00","updated_at":"2026-11-06T17:45:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T17:45:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeScout to `1.8.226` or later.","reach":"network","title":"FreeScout: restricted agents can read other conversations' replies and notes","impact":"medium","summary":"FreeScout, a self-hosted help desk, lets an authenticated user with assigned-only access subscribe to realtime channels for conversations they are not assigned to. Those event payloads can expose replies, internal notes, recipient addresses, assignee data and attachment download links.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freescout","self-hosted","help-desk","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Restricted staff read other conversations' replies, notes and attachment links","analyst_note":"","how_to_check":"- Check the installed FreeScout version and compare it with the fixed release listed in the sources.\n- Review which staff accounts are set to see only assigned conversations.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","no-restricted-users"],"who_is_affected":"Self-hosted FreeScout installations before 1.8.226 where some staff accounts are restricted to assigned conversations only. Any such user with a valid login can receive realtime data for other conversations in the same mailbox. Installations on managed hosting or with no restricted users are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":4353,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62852':13A,16A '1.8.226':82C,154C 'access':41B,88C 'address':62B,134C 'agent':3A 'appli':92C 'assign':39B,51B,104C 'assigne':63B,137C 'assigned-on':38B 'attach':66B,139C,142C 'authent':35B,108C 'channel':45B,116C 'check':84C 'complet':129C 'configur':100C 'contain':144C 'conv':114C 'convers':7A,47B,95C,105C,119C,135C 'conversation-level':94C 'cve':11A,14A 'data':64B,138C 'desk':20B,32B,76C 'download':67B,146C 'event':54B,125C 'expos':57B,128C 'fix':151C 'freescout':1A,17B,26B,69C 'general':86C 'help':19B,31B,75C 'help-desk':18B 'host':25B,30B,74C 'intern':59B,131C 'issu':149C 'let':33B 'level':96C 'link':68B 'mailbox':79C,87C,123C 'name':140C 'new':124C 'note':10A,60B,132C 'packag':21B 'payload':55B,126C 'php':22B 'polycast':115C 'predict':113C 'prior':80C 'read':5A 'realtim':44B 'realtimeconvnewthread':83C 'recipi':61B,133C 'repli':8A,58B,130C 'restrict':2A,97C,107C 'see':102C 'self':24B,29B,73C 'self-host':23B,28B,72C 'share':78C 'state':136C 'subscrib':42B,111C 'token':147C 'url':143C 'user':36B,99C,109C 'valid':145C 'version':153C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FreeScout installations before 1.8.226 where some staff accounts are restricted to assigned conversations only. Any such user with a valid login can receive realtime data for other conversations in the same mailbox. Installations on managed hosting or with no restricted users are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freescout","helpdesk","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-62852':13A,16A 'agent':3A 'convers':7A 'cve':11A,14A 'freescout':1A 'note':10A 'read':5A 'repli':8A 'restrict':2A","search_b":"'access':41B 'address':62B 'assign':39B,51B 'assigne':63B 'assigned-on':38B 'attach':66B 'authent':35B 'channel':45B 'convers':47B 'data':64B 'desk':20B,32B 'download':67B 'event':54B 'expos':57B 'freescout':17B,26B 'help':19B,31B 'help-desk':18B 'host':25B,30B 'intern':59B 'let':33B 'link':68B 'note':60B 'packag':21B 'payload':55B 'php':22B 'realtim':44B 'recipi':61B 'repli':58B 'self':24B,29B 'self-host':23B,28B 'subscrib':42B 'user':36B","search_c":"'1.8.226':82C,154C 'access':88C 'address':134C 'appli':92C 'assign':104C 'assigne':137C 'attach':139C,142C 'authent':108C 'channel':116C 'check':84C 'complet':129C 'configur':100C 'contain':144C 'conv':114C 'convers':95C,105C,119C,135C 'conversation-level':94C 'data':138C 'desk':76C 'download':146C 'event':125C 'expos':128C 'fix':151C 'freescout':69C 'general':86C 'help':75C 'host':74C 'intern':131C 'issu':149C 'level':96C 'mailbox':79C,87C,123C 'name':140C 'new':124C 'note':132C 'payload':126C 'polycast':115C 'predict':113C 'prior':80C 'realtimeconvnewthread':83C 'recipi':133C 'repli':130C 'restrict':97C,107C 'see':102C 'self':73C 'self-host':72C 'share':78C 'state':136C 'subscrib':111C 'token':147C 'url':143C 'user':99C,109C 'valid':145C 'version':153C","first_public_at":"2026-07-15T09:58:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62852","severity":null,"published_at":"2026-11-06T17:18:33+00:00","modified_at":"2026-11-06T17:18:33+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","fetched_at":"2026-11-06T17:43:14+00:00","note":null}],"documents":[{"id":88387,"url":"https://github.com/freescout-help-desk/freescout/commit/e47a54a5af6c57181ef99711326f5886e940b776","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88385,"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88389,"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w668-wq26-6c94","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-15T09:58:10+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}