{"affected":[{"product":"freescout","source":"CNA: GitHub_M","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.225"}]},{"ecosystem":"","packageName":"freescout-help-desk/freescout","product":"freescout-help-desk/freescout","source":"GitHub GHSA-w2p9-3666-vw9j","vendor":"","versions":[{"status":"affected","version":"<1.8.225","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-62850","cwes":["CWE-287","CWE-307","CWE-538"],"description":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.","epss":{"date":"2026-11-10","percentile":0.19729,"score":0.00272},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794366723535,"publishedAt":1793984668448,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/commit/8bb0594e95eab6661b4372e94ac02f62a6c3cb28"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/commit/8bb0594e95eab6661b4372e94ac02f62a6c3cb28"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-w2p9-3666-vw9j","text":"freescout-help-desk/freescout: GitHub reports patched versions 1.8.225. Check the advisory for the affected release branch.","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j"}],"revision":"f264298c080c80436130176d69c8c3c19dd6ef71b3e61ba5e16b080f92aa2259","sources":[{"modifiedAt":1794366723535,"name":"CNA: GitHub_M","retrievedAt":1794370170905,"url":"https://www.cve.org/CVERecord?id=CVE-2026-62850"},{"modifiedAt":1793985513157,"name":"NVD","retrievedAt":1793990254620,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62850"},{"modifiedAt":1784109380000,"name":"GitHub Security Advisories","retrievedAt":1794137109508,"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2p9-3666-vw9j"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794370186705,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62850"}],"ssvc":{"assessedAt":1794366693664,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets","updatedAt":1794370186705}