CVE-2026-62856 · Package
NO FIX YET · SEE WHAT TO DO
FreeScout, a self-hosted help desk application, has a polycast/receive endpoint that does not escape SQL LIKE wildcards in channel names. A guest user with a session and CSRF token can read notification events, including conversation message content, intended for other users and mailboxes.
first public Jul 15, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a self-hosted FreeScout instance below 1.8.226 and allow guest sessions can have conversation content exposed across users and mailboxes. Hosted or other help desk products are not indicated by the sources.
Not affected if no-guest-access, version-1.8.226-or-later
Who cares freescout, help-desk, self-hosted
1.8.226.1.8.226 or later.FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. This issue is fixed in version 1.8.226.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.