Description

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T17:18:33.537Z",
  "pubdate": "2026-11-06T17:18:33.537Z",
  "executiveSummary": "This vulnerability is an improper authorization flaw within the RealtimeConvNewThread functionality of FreeScout, a self-hosted help desk platform.\nThe issue permits authenticated users with restricted access permissions to bypass conversation-level visibility constraints.\nBy subscribing to predictable Polycast channels (conv.<conversation_id>), an attacker can intercept real-time updates for conversations they are not authorized to view.\nThe impact includes the unauthorized disclosure of sensitive data, including complete customer replies, internal notes, recipient PII, conversation metadata, and private attachment download tokens.\nThis vulnerability affects FreeScout versions prior to 1.8.226.\nSuccessful exploitation requires authenticated access to the system, but does not require administrative privileges, posing a significant risk for environments utilizing restrictive user-to-conversation assignments.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient authorization check within the RealtimeConvNewThread logic. While the application correctly validates general mailbox access, it fails to enforce granular conversation-level restrictions for users configured to view only assigned conversations.\nFreeScout utilizes the Polycast protocol for real-time communication, broadcasting event updates through specific channels. These channels follow a predictable naming convention: conv.<conversation_id>.\nThe attack flow proceeds as follows: 1) An authenticated user with restricted visibility permissions identifies a target conversation ID. 2) The user crafts a subscription request for the corresponding Polycast channel (conv.<conversation_id>) despite lacking authorization for that specific thread. 3) The backend, failing to perform an object-level access control check during the channel subscription process, erroneously authorizes the connection. 4) The server begins pushing real-time event payloads to the attacker's session.\nThe payloads delivered through this channel are comprehensive. They include full conversational content, internal notes which often contain sensitive diagnostic information or internal deliberations, recipient email addresses, current conversation state, assignee data, and direct URLs for file attachments. Critically, these attachment URLs contain valid, unexpired download tokens, allowing the attacker to bypass file access restrictions and download sensitive documents associated with the unauthorized conversations.\nThis vulnerability effectively escalates the privileges of a restricted user, allowing them to perform unauthorized data exfiltration across the platform. The lack of validation on the channel subscription allows for the passive and real-time monitoring of Help Desk activity, potentially compromising both customer data and internal corporate communication.\nAffected versions include all iterations of FreeScout prior to 1.8.226. The vulnerability resides in the application's real-time messaging handling component, where the security context of the user is insufficiently reconciled with the requested channel resource during the subscription handshake."
}