What is the CVSS score of CVE-2026-48812?

CVE-2026-48812 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of FreeScout are affected by CVE-2026-48812?

FreeScout help desk instances running versions prior to 1.8.221 have an authentication bypass enabling unauthenticated attackers to download arbitrary ticket attachments.. A patch is available.

How to fix or mitigate CVE-2026-48812?

Within 24 hours, identify all FreeScout deployments and confirm which are running versions below 1.8.221. Within 7 days, upgrade all vulnerable instances to FreeScout version 1.8.221 or later to apply this security fix. Within 30 days, audit access logs to determine if the vulnerability was exploited, assess the sensitivity of potentially exposed attachments, and document findings for incident response purposes.

FreeScout CVE-2026-48812

EUVD-2026-46044 HIGH

Improper Authentication (CWE-287)

2026-07-20 GitHub_M

Authentication Bypass Freescout

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network download route bypasses token auth (PR:N/UI:N/AC:L) leaking file contents, so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 20, 2026 - 19:03 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 18:17 vuln.today

Analysis Generated

Jul 20, 2026 - 18:17 vuln.today

CVE Published

Jul 20, 2026 - 17:32 cve.org

HIGH 7.5

DescriptionCVE.org

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose token_type is set to 1 (TOKEN_TYPE_LEGACY). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. Version 1.8.221 contains a fix.

AnalysisAI

Broken authentication in FreeScout (a PHP/Laravel self-hosted help desk and shared inbox) prior to version 1.8.221 lets an unauthenticated remote attacker download arbitrary attachments whose token_type is set to 1 (TOKEN_TYPE_LEGACY). The download route bypasses token verification for these legacy attachments, and because file paths are deterministic, any attachment created by an older FreeScout instance can be retrieved without a valid token or session. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach public FreeScout download route

Delivery

Reference legacy (token_type=1) attachment path

Exploit

Request without valid token

Execution

Auth check bypassed for legacy type

Impact

Server returns confidential attachment

Access

Reach public FreeScout download route

Delivery

Reference legacy (token_type=1) attachment path

Exploit

Request without valid token

Execution

Auth check bypassed for legacy type

Impact

Server returns confidential attachment

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target attachment was created by an older FreeScout version and therefore carries token_type = 1 (TOKEN_TYPE_LEGACY); attachments without this legacy type still enforce token validation and are not exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, high confidentiality impact and no integrity/availability impact - a pure unauthenticated information-disclosure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who knows or can enumerate the deterministic storage path structure sends an unauthenticated HTTP GET to the FreeScout attachment download route for a legacy (token_type=1) file, omitting or supplying any token value. Because the server skips token validation for legacy attachments, it returns the file - potentially confidential support-ticket contents such as invoices, PII, credentials, or internal documents. …
Remediation	Vendor-released patch: upgrade FreeScout to version 1.8.221 or later, which removes the TOKEN_TYPE_LEGACY exemption so every attachment download requires a matching content-hash token (see the advisory at https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg74-ww4w-2qpc and fix commit https://github.com/freescout-help-desk/freescout/commit/215241ee2eb73eaa3b47e392599c7dc1b427dc7e). … Detailed patch versions, workarounds, and compensating controls in full report.