FreeScout < 1.8.225 - Unauthenticated Maintenance File Existence Oracle

FreeScout before 1.8.225 exposes the maintenance endpoint /tools.php without authentication; different responses to existing and non-existing PHP paths disclose filesystem path existence before credential validation. id: CVE-2026-62850 info: name: FreeScout 1.8.225 - Unauthenticated Maintenance...