FreeScout EUVD-2026-46044

Exploitation requires that the target attachment was created by an older FreeScout version and therefore carries token_type = 1 (TOKEN_TYPE_LEGACY); attachments without this legacy type still enforce token validation and are not exposed. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, session, or user interaction is needed and the download route is reachable over the network, so against a vulnerable instance holding legacy attachments this is remote and unauthenticated. The practical limiting factors are: the instance must be running a version prior to 1.8.221, it must actually contain legacy-typed attachments (freshly deployed recent installs have none to leak), and the attacker must reach the attachment download route and reference a valid deterministic file path.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, high confidentiality impact and no integrity/availability impact - a pure unauthenticated information-disclosure flaw. No EPSS score, KEV entry, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of a KEV listing means there is no confirmation of active exploitation. Real-world impact is bounded by a concrete precondition: only attachments carrying the legacy token_type (i.e. files created by older FreeScout versions) are exposed, so instances that were freshly deployed on recent versions with no legacy data have little to steal, while long-lived upgraded installations holding years of support-ticket attachments are at meaningful risk. Because the flaw is trivially reachable and the disclosing commit is public, treat it as a real priority for any internet-exposed, long-running FreeScout install even though headline exploitation signals (EPSS/KEV/POC) are absent.

An attacker who knows or can enumerate the deterministic storage path structure sends an unauthenticated HTTP GET to the FreeScout attachment download route for a legacy (token_type=1) file, omitting or supplying any token value. Because the server skips token validation for legacy attachments, it returns the file - potentially confidential support-ticket contents such as invoices, PII, credentials, or internal documents. No POC was provided in the intelligence, but the flawed conditional is disclosed in the public fix commit, lowering the bar to reproduce.