CVE-2026-62856
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-89
Neutralización incorrecta de elementos especiales usados en un comando SQL (Inyección SQL)
Fecha de publicación:
06/11/2026
Última modificación:
06/11/2026
Descripción
*** Pendiente de traducción *** FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. This issue is fixed in version 1.8.226.
Impacto
Puntuación base 3.x
7.70
Gravedad 3.x
ALTA
Referencias a soluciones, herramientas e información
- https://github.com/freescout-help-desk/freescout/commit/1f4deee6369d89a70d291248499883b5bfdb99ff
- https://github.com/freescout-help-desk/freescout/commit/656cb2349cd3bb11f04f01c1587900dfb423a855
- https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj