CVE-2026-62856

FreeScout is a self-hosted help desk and shared mailbox application.

FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a…

6. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-62856