PT-2026-61667 · Freescout · Freescout

CVE-2026-48812 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.221

Description An unauthenticated remote attacker can download attachments created by older versions of the software. This occurs because the attachment download route skips token authentication when the token type variable is set to 1 (TOKEN TYPE LEGACY). Since this route is unauthenticated and the file path is deterministic, files can be accessed without a valid token or session.

Recommendations Update to version 1.8.221.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-48812

GHSA-WG74-WW4W-2QPC

Affected Products

Freescout

References · 6

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg74-ww4w-2qpc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48812.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-48812 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48812 · Vendor Advisory
• https://github.com/freescout-help-desk/freescout/commit/215241ee2eb73eaa3b47e392599c7dc1b427dc7e · Note
• https://twitter.com/VulmonFeeds/status/2079368501081330119 · Twitter Post