freescout-help-desk vulnerabilities

CVEs per yearBy the year they were published

1. 202526
2. 202659

Newest CVEs

• CVE-2026-85742

  FreeScout: Conditional stored admin XSS via failed-job details

  freescout-help-desk · freescout

  High7.5
• CVE-2026-103985

  FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile save

  freescout-help-desk · freescout

  High7.1
• CVE-2026-103984

  FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII

  freescout-help-desk · freescout

  Medium6.5
• CVE-2026-85743

  FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks

  freescout-help-desk · freescout

  High8.2
• CVE-2026-85744

  FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass

  freescout-help-desk · freescout

  Medium5.4
• CVE-2026-62850

  FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets

  freescout-help-desk · freescout

  Medium5.3
• CVE-2026-62852

  FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key

  freescout-help-desk · freescout

  Medium6.5
• CVE-2026-62855

  FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files

  freescout-help-desk · freescout

  Medium4.4
• CVE-2026-62851

  FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortcut (missing mailbox authorization)

  freescout-help-desk · freescout

  Medium4.3
• CVE-2026-62856

  FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query

  freescout-help-desk · freescout

  High7.7