CVE-2026-62851

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.226

Description An authenticated non-admin agent who is a member of at least one mailbox can exploit a search-by-number shortcut in the search() function of ConversationsController. By requesting the '/search' endpoint with a hash-prefixed ticket number, the system resolves the user-controlled ticket number without applying the required mailbox filter or view policy. This allows the agent to use the 302 Location header to confirm the existence of a conversation in a mailbox they cannot access and discover its internal conversation and folder identifiers. This issue does not disclose message content, attachments, or customer data.

Recommendations Update to version 1.8.226.