{"id":"CVE-2026-62856","kind":"vulnerability","aliases":["CVE-2026-62856"],"related":[],"title":"FreeScout: wildcard channel names leak other users' conversation messages","description":"FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the  polycast/receive  endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. This issue is fixed in version 1.8.226.","summary":"FreeScout, a self-hosted help desk application, has a polycast/receive endpoint that does not escape SQL LIKE wildcards in channel names. A guest user with a session and CSRF token can read notification events, including conversation message content, intended for other users and mailboxes.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freescout","help-desk","package","self-hosted"],"not_affected_if":["no-guest-access","version-1.8.226-or-later"],"how_to_check":"- Check the installed FreeScout version and see whether it is below `1.8.226`.\n- Confirm whether the instance is reachable by guest sessions on the polycast/receive endpoint (unknown if the sources do not say more).","fix":"- FreeScout: upgrade to `1.8.226` or later.","status":"open","published_at":"2026-11-06T17:18:34+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","triaged_at":"2026-11-06T17:45:01+00:00","updated_at":"2026-11-06T17:45:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T17:45:01Z","model":"claude-haiku-5-5","output":{"fix":"- FreeScout: upgrade to `1.8.226` or later.","reach":"internet","title":"FreeScout: wildcard channel names leak other users' conversation messages","impact":"high","summary":"FreeScout, a self-hosted help desk application, has a polycast/receive endpoint that does not escape SQL LIKE wildcards in channel names. A guest user with a session and CSRF token can read notification events, including conversation message content, intended for other users and mailboxes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freescout","self-hosted","help-desk"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads other users' conversation messages and notification content","analyst_note":"","how_to_check":"- Check the installed FreeScout version and see whether it is below `1.8.226`.\n- Confirm whether the instance is reachable by guest sessions on the polycast/receive endpoint (unknown if the sources do not say more).","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.8.226-or-later","no-guest-access"],"who_is_affected":"Teams that run a self-hosted FreeScout instance below 1.8.226 and allow guest sessions can have conversation content exposed across users and mailboxes. Hosted or other help desk products are not indicated by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4374,"output_tokens":511,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62856':12A,15A '1.8.226':84C,161C 'access':140C 'across':151C 'appli':101C 'applic':31B,80C 'attack':110C 'author':100C 'channel':3A,44B,96C,99C,123C 'check':141C 'content':62B,145C 'convers':8A,60B,143C 'correspond':139C 'csrf':53B,117C 'cve':10A,13A 'desk':19B,30B,76C 'endpoint':35B,87C 'escap':39B,90C 'event':58B,129C 'expos':142C 'fail':88C 'fix':158C 'freescout':1A,16B,24B,69C 'generat':136C 'guest':47B,113C 'help':18B,29B,75C 'help-desk':17B 'host':23B,28B,74C 'html':150C 'identifi':146C 'includ':59B 'intend':63B,130C 'issu':156C 'lack':137C 'leak':5A 'like':41B,92C 'mailbox':68B,79C,154C 'match':127C 'messag':9A,61B,144C 'name':4A,45B,97C,104C,124C 'notif':57B,128C,134C,149C 'packag':20B 'payload':135C 'polycast/receive':34B,86C 'prefix':107C 'prior':81C 'read':56B 'retriev':126C 'self':22B,27B,73C 'self-host':21B,26B,72C 'session':51B,114C 'share':78C 'specif':106C 'sql':40B,91C 'submit':120C 'suppli':95C 'token':54B,118C 'unauthent':109C 'url':147C 'user':7A,48B,66B,133C,152C 'valid':116C 'version':83C,160C 'wildcard':2A,42B,93C,122C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted FreeScout instance below 1.8.226 and allow guest sessions can have conversation content exposed across users and mailboxes. Hosted or other help desk products are not indicated by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freescout","helpdesk","high","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-62856':12A,15A 'channel':3A 'convers':8A 'cve':10A,13A 'freescout':1A 'leak':5A 'messag':9A 'name':4A 'user':7A 'wildcard':2A","search_b":"'applic':31B 'channel':44B 'content':62B 'convers':60B 'csrf':53B 'desk':19B,30B 'endpoint':35B 'escap':39B 'event':58B 'freescout':16B,24B 'guest':47B 'help':18B,29B 'help-desk':17B 'host':23B,28B 'includ':59B 'intend':63B 'like':41B 'mailbox':68B 'messag':61B 'name':45B 'notif':57B 'packag':20B 'polycast/receive':34B 'read':56B 'self':22B,27B 'self-host':21B,26B 'session':51B 'sql':40B 'token':54B 'user':48B,66B 'wildcard':42B","search_c":"'1.8.226':84C,161C 'access':140C 'across':151C 'appli':101C 'applic':80C 'attack':110C 'author':100C 'channel':96C,99C,123C 'check':141C 'content':145C 'convers':143C 'correspond':139C 'csrf':117C 'desk':76C 'endpoint':87C 'escap':90C 'event':129C 'expos':142C 'fail':88C 'fix':158C 'freescout':69C 'generat':136C 'guest':113C 'help':75C 'host':74C 'html':150C 'identifi':146C 'intend':130C 'issu':156C 'lack':137C 'like':92C 'mailbox':79C,154C 'match':127C 'messag':144C 'name':97C,104C,124C 'notif':128C,134C,149C 'payload':135C 'polycast/receive':86C 'prefix':107C 'prior':81C 'retriev':126C 'self':73C 'self-host':72C 'session':114C 'share':78C 'specif':106C 'sql':91C 'submit':120C 'suppli':95C 'token':118C 'unauthent':109C 'url':147C 'user':133C,152C 'valid':116C 'version':83C,160C 'wildcard':93C,122C","first_public_at":"2026-07-15T09:59:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62856","severity":null,"published_at":"2026-11-06T17:18:34+00:00","modified_at":"2026-11-06T17:18:34+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","fetched_at":"2026-11-06T17:43:14+00:00","note":null}],"documents":[{"id":88397,"url":"https://github.com/freescout-help-desk/freescout/commit/1f4deee6369d89a70d291248499883b5bfdb99ff","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88398,"url":"https://github.com/freescout-help-desk/freescout/commit/656cb2349cd3bb11f04f01c1587900dfb423a855","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88385,"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88400,"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-15T09:59:27+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}