Unauthenticated access to legacy attachments in FreeScout (CVE-2026-48812)

FreeScout's attachment download route contains a logical flaw in its token validation check that unconditionally grants access to any attachment whose `token_type` is set to `TOKEN_TYPE_LEGACY` (value `1`), bypassing authentication entirely. Because the file storage path is computed deterministically from the sequential attachment database ID, an unauthenticated remote attacker can enumerate and download any legacy attachment without a valid token or session. Affected versions: - <1.8.221 We recommend updating to: 1.8.221. CVSS 7.5 · our assessment: this_week Reference: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg74-ww4w-2qpc Details: https://vuln.today/cve/CVE-2026-48812