CVE-2026-62852

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.226

Description An issue exists where the RealtimeConvNewThread function only verifies general mailbox access and fails to enforce conversation-level restrictions for users limited to viewing assigned conversations. An authenticated user with restricted permissions can subscribe to predictable conv.<conversation id> Polycast channels for other conversations within the same mailbox. This can lead to the exposure of sensitive data in new event payloads, including complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs with valid download tokens.

Recommendations Update to version 1.8.226.