What is the CVSS score of CVE-2026-48812?

CVE-2026-48812 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of FreeScout are affected by CVE-2026-48812?

FreeScout help desk instances running versions prior to 1.8.221 have an authentication bypass enabling unauthenticated attackers to download arbitrary ticket attachments.. A patch is available.

How to fix or mitigate CVE-2026-48812?

Within 24 hours, identify all FreeScout deployments and confirm which are running versions below 1.8.221. Within 7 days, upgrade all vulnerable instances to FreeScout version 1.8.221 or later to apply this security fix. Within 30 days, audit access logs to determine if the vulnerability was exploited, assess the sensitivity of potentially exposed attachments, and document findings for incident response purposes.

FreeScout CVE-2026-48812

EUVD-2026-46044 HIGH

Improper Authentication (CWE-287)

2026-07-20 GitHub_M

Authentication Bypass Freescout Freescout Help Desk

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network download route bypasses token auth (PR:N/UI:N/AC:L) leaking file contents, so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 20, 2026 - 19:03 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 18:17 vuln.today

Analysis Generated

Jul 20, 2026 - 18:17 vuln.today

CVE Published

Jul 20, 2026 - 17:32 cve.org

HIGH 7.5

DescriptionCVE.org

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose token_type is set to 1 (TOKEN_TYPE_LEGACY). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. Version 1.8.221 contains a fix.

AnalysisAI

Broken authentication in FreeScout (a PHP/Laravel self-hosted help desk and shared inbox) prior to version 1.8.221 lets an unauthenticated remote attacker download arbitrary attachments whose token_type is set to 1 (TOKEN_TYPE_LEGACY). The download route bypasses token verification for these legacy attachments, and because file paths are deterministic, any attachment created by an older FreeScout instance can be retrieved without a valid token or session. There is no public exploit identified at time of analysis, but the upstream commit disclosing the exact flawed conditional is public.

Technical ContextAI

FreeScout serves attachments through OpenController::downloadAttachment(), an unauthenticated 'open' route intended to let recipients fetch files via a signed token that hashes the file contents. The vulnerable conditional (if ($token != $attachment->getToken() && $attachment->token_type != Attachment::TOKEN_TYPE_LEGACY)) short-circuits the token check whenever an attachment's token_type equals the legacy constant value of 1, so legacy-typed attachments are served with no token validation at all. This is a classic CWE-287 Improper Authentication case: a backward-compatibility branch that was never removed effectively disables the auth gate for a subset of objects. The affected component is the freescout-help-desk/freescout application (cpe:2.3:a:freescout-help-desk:freescout), and the fix removes the TOKEN_TYPE_LEGACY exemption entirely so every attachment request must present a matching content-hash token.

RemediationAI

Vendor-released patch: upgrade FreeScout to version 1.8.221 or later, which removes the TOKEN_TYPE_LEGACY exemption so every attachment download requires a matching content-hash token (see the advisory at https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg74-ww4w-2qpc and fix commit https://github.com/freescout-help-desk/freescout/commit/215241ee2eb73eaa3b47e392599c7dc1b427dc7e). If you cannot upgrade immediately, restrict network exposure of the /storage attachment download route - for example place the instance behind authenticated VPN/SSO or an IP allowlist, or use a reverse proxy rule to require authentication before reaching the open download endpoint; the trade-off is that legitimate token-based public attachment links sent to external requesters will also break. As a data-side control you can migrate or re-tokenize legacy attachments so none retain token_type=1, but this requires care to avoid breaking existing references. Do not rely on obscurity of file paths, since the description states they are deterministic.