CVE-2026-62856
Received Received - Intake

SQL Injection in FreeScout Help Desk

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: GitHub, Inc.

Description
FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the  polycast/receive  endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. This issue is fixed in version 1.8.226.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-62856
EUVD
EUVD-2026-118369

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freescout freescout to 1.8.226 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62856 is a vulnerability in FreeScout, a self-hosted help desk application. The issue occurs in the polycast/receive endpoint where SQL LIKE wildcards in channel names are not properly escaped. This allows an unauthenticated attacker with a guest session and valid CSRF token to submit a wildcard channel name (e.g., %) to retrieve notification events intended for other users. The vulnerability stems from unescaped LIKE wildcards in SQL queries, insufficient authorization checks, and missing access controls in payload data fetching.

Detection Guidance

To detect this vulnerability, check if your FreeScout instance is running a version prior to 1.8.226. Run: grep -r '1.8.226' /path/to/freescout/ or check the version in the admin panel. Inspect network traffic for suspicious POST requests to /polycast/receive with wildcard channel names like % or _. Monitor database queries for unsanitized LIKE clauses in the polycast_events table.

Impact Analysis

An attacker could exploit this to access sensitive data such as conversation messages, user identifiers, URLs, and notification HTML across different users and mailboxes. This could lead to unauthorized disclosure of private or confidential information, including admin conversations and customer data. The attack requires minimal prerequisites like a valid session and CSRF token.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of personal data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using affected FreeScout versions may face compliance violations, legal penalties, and reputational damage due to data breaches.

Mitigation Strategies

Upgrade FreeScout to version 1.8.226 or later immediately. Apply the patches from the GitHub commits referenced in Resources 2 and 3. Ensure all /polycast/receive endpoints enforce strict authentication and authorization checks. Review and sanitize all user-supplied input in SQL LIKE queries, particularly channel names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62856. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...