CVE-2026-48812
Received Received - Intake

Unauthenticated File Download in FreeScout

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. Version 1.8.221 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-48812
EUVD
EUVD-2026-46044

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freescout freescout to 1.8.221 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48812 is a vulnerability in FreeScout, a help desk software, affecting versions before 1.8.221. It allows unauthenticated access to legacy attachment files due to a flaw in token authentication. The attachment download endpoint lacks proper authentication, letting attackers download sensitive files by guessing file paths based on database IDs.

Detection Guidance

Check FreeScout version with: grep -r "version" /path/to/freescout/config/app.php. If version is below 1.8.221, the system is vulnerable. Inspect web server access logs for suspicious download attempts targeting /attachment/download/{id} without valid tokens.

Impact Analysis

This vulnerability could allow attackers to access sensitive files such as customer-submitted documents, contracts, invoices, or personal data without authentication. If you use FreeScout versions prior to 1.8.221, attackers can enumerate and download attachments by exploiting the unauthenticated download route.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. GDPR mandates strict protection of personal data, while HIPAA requires safeguarding protected health information. Unauthorized access may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update FreeScout to version 1.8.221 or later. If immediate update is not possible, disable legacy attachment access by modifying app/Http/Controllers/OpenController.php to remove the token_type bypass check for TOKEN_TYPE_LEGACY.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48812. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart