{"affected":[{"product":"freescout","source":"CNA: GitHub_M","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.226"}]}],"cveId":"CVE-2026-62856","cwes":["CWE-89","CWE-200","CWE-639"],"description":"FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the  polycast/receive  endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. This issue is fixed in version 1.8.226.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},{"score":7.7,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793985514047,"publishedAt":1793984433424,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/commit/1f4deee6369d89a70d291248499883b5bfdb99ff"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/commit/656cb2349cd3bb11f04f01c1587900dfb423a855"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/commit/1f4deee6369d89a70d291248499883b5bfdb99ff"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/commit/656cb2349cd3bb11f04f01c1587900dfb423a855"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.226"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-gh3r-jh6q-wrvj"}],"remediation":[],"revision":"e35148120372a018bdf0e777ff50844c727b636c8bfff9a126b930f3e7df493c","sources":[{"modifiedAt":1793984433424,"name":"CNA: GitHub_M","retrievedAt":1793985644340,"url":"https://www.cve.org/CVERecord?id=CVE-2026-62856"},{"modifiedAt":1793985514047,"name":"NVD","retrievedAt":1793990256520,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62856"}],"ssvc":null,"status":"published","title":"FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query","updatedAt":1793990256520}