CVE-2026-62850

CVSS 5.3 (medium) · published 2026-11-06

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.

Weakness: CWE-287, CWE-307, CWE-538

Source: NVD CVE-2026-62850

References

• https://github.com/freescout-help-desk/freescout/commit/8bb0594e95eab6661b4372e94ac02f62a6c3cb28
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.