FreeScout < 1.8.225 - Unauthenticated Maintenance File Existence Oracle

FreeScout before 1.8.225 exposes the maintenance endpoint /tools.php without authentication; different responses to existing and non-existing PHP paths disclose filesystem path existence before credential validation. id: CVE-2026-62850 info: name: FreeScout 1.8.225 - Unauthenticated Maintenance...

FreeScout < 1.8.224 - Invite Hash Authorization Bypass

FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invitehash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication. id: CVE-2026-53595 info:...

CVE-2026-28289

🚨 CVE-2026-28289 — “Mail2Shell” Zero-Click Unauthenticated RCE in FreeScout via Email Attachment Bypass 📖 Overview CVE-2026-28289 , nicknamed Mail2Shell , is a critical zero-click Remote Code Execution RCE vulnerability affecting FreeScout. An attacker can send a specially crafted email to a...

CVE-2026-53595_exploit

CVE-2026-53595 + CVE-2026-53593 — FreeScout Anonymous ATO → RCE Unauthenticated remote code execution in FreeScout ≤ 1.8.223 a Laravel help desk by chaining two flaws, both fixed in 1.8.224 : CVE-2026-53595 — anonymous account takeover. POST /user-setup/hash/invitesentat picks the account by its...

CVE-2026-35584

CVE-2026-35584 POC - CVE-2026-35584 FreeScout Description Summary The endpoint GET /thread/read/conversationid/threadid does not require authentication and does not validate whether the given threadid belongs to the given conversationid. This allows any unauthenticated attacker to: Mark any threa...

CVE-2026-27636

Passive reconnaissance and fingerprinting tool for detecting FreeScout deployments and analyzing exposure related to CVE-2026-28289. This script focuses on safe infrastructure intelligence gathering rather than exploitation. It helps researchers and defenders understand how FreeScout instances ar...

CVE-2023-52268

FreeScout End-User Portal Authentication Bypass Exploit CVE-2023-52268 Overview This exploit targets a vulnerability in the FreeScout End-User Portal Module versions below 1.0.65 that allows an attacker to bypass authentication through improper session token management. By generating and testing...

CVE-2026-28289

🚨 CVE-2026-28289 — “Mail2Shell” Zero-Click Unauthenticated RCE in FreeScout via Email Attachment Bypass 📖 Overview CVE-2026-28289 , nicknamed Mail2Shell , is a critical zero-click Remote Code Execution RCE vulnerability affecting FreeScout. An attacker can send a specially crafted email to a...

VulnCheck KEV: CVE-2026-62856

FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a...

CVE-2026-85742

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failedjobs...

CVE-2026-85744

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversationmerge action records a failed authorization check for the target conversation in response'msg' and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation...

CVE-2026-85743

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile, Helper::checkPort, Helper::sanitizeRemoteUrl, MailboxesController.php, and ModulesController.php do not consistently enforce a sink-level restricted-host policy. An...

CVE-2026-62856

FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a...

CVE-2026-62855

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrator-only App Logs viewer accepts Laravel-encrypted folder and file parameters whose constructed path is checked only as a raw string. An administrator who also knows the APPKEY can supply traversal segments...

CVE-2026-62851

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in ConversationsController::search resolves a user-controlled ticket number without applying the mailbox filter or view policy used by the normal search path. An authenticated non-admin agent...

CVE-2026-62854

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags. The resulting external script is served from the same...

CVE-2026-62850

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directori...

CVE-2026-62852

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to...

CVE-2026-103984

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limitusercustomervisibility is enabled, the loadcustomerinfo AJAX action performs a global lookup using an attacker-controlled customer email and checks only whether the agent can access a separately supplied mailbox....

CVE-2026-103985

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the onlyassignedtickets permission to its non-admin owner, and UsersController::profileSave adds or removes User::PERMONLYASSIGNEDTICKETS without checking that the editor is an administrator. A...