CVE-2026-48812CWE-287

FreeScout Allows Unauthenticated Access to Legacy Attachment Files

High · published July 20, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. Version 1.8.221 contains a fix.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00633 · 49.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-07-20T17:32Z
EPSS history
Timeline
  • 20 JUL 17:32Z
    FreeScout Allows Unauthenticated Access to Legacy Attachment Files
    cvelistv5