CVE-2026-48812: FreeScout Auth Bypass Vulnerability

CVE-2026-48812 Overview

CVE-2026-48812 is an authentication bypass vulnerability [CWE-287] in FreeScout, a PHP Laravel-based help desk and shared inbox application. The flaw resides in the attachment download route, which skips token validation when an attachment's token_type equals 1 (TOKEN_TYPE_LEGACY). An unauthenticated remote attacker can request legacy attachments by their deterministic file path and retrieve them without a valid token or session. All versions prior to 1.8.221 are affected. The maintainers released 1.8.221 to remove the legacy token exemption and enforce token validation on every request.

Critical Impact
Unauthenticated remote attackers can download any attachment created by older FreeScout versions, exposing customer support correspondence, credentials, and internal documents.

Affected Products

FreeScout versions prior to 1.8.221
FreeScout instances with attachments created by older releases where token_type = 1
Self-hosted FreeScout deployments exposing the public attachment download route

Discovery Timeline

2026-07-20 - CVE-2026-48812 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-48812

Vulnerability Analysis

FreeScout serves file attachments through an unauthenticated route in app/Http/Controllers/OpenController.php. The controller compares a caller-supplied token against the attachment's computed token. Before the patch, the comparison contained a bypass condition: if the attachment's token_type equaled Attachment::TOKEN_TYPE_LEGACY (1), the token check was skipped entirely. Legacy attachments were created by older FreeScout versions and remain stored with token_type = 1 after upgrade. Because the download route is public and attachment identifiers are deterministic, an attacker who can guess or enumerate attachment IDs can pull files directly. The impact is limited to confidentiality; integrity and availability are unaffected.

Root Cause

The root cause is a broken access control check that treated a specific token_type value as an implicit trust marker. The exemption was intended to preserve backward compatibility with links generated by earlier FreeScout releases. It effectively converted every legacy attachment into a public resource, disabling authentication for that class of files.

Attack Vector

Exploitation requires only network access to a vulnerable FreeScout instance. The attacker issues an HTTP GET to the attachment download endpoint with any (or empty) token value. If the referenced attachment carries token_type = 1, the server returns the file contents. No credentials, session cookies, or user interaction are required.

php

// Vulnerable check in app/Http/Controllers/OpenController.php (pre-1.8.221)
// Only allow download if the attachment is public or if the token matches the hash of the contents
if ($token != $attachment->getToken() && $attachment->token_type != Attachment::TOKEN_TYPE_LEGACY) {
    return \Helper::denyAccess();
}

// Patched check in 1.8.221
// Links to attachments without token have been disabled.
// https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg74-ww4w-2qpc
if ($token != $attachment->getToken()) {
    return \Helper::denyAccess();
}

Source: FreeScout security commit 215241e

Detection Methods for CVE-2026-48812

Indicators of Compromise

Web server access logs showing repeated GET requests to attachment download paths with missing, empty, or invalid token query parameters.
Sequential or enumerated attachment ID patterns in access logs from a single source address.
Unusually high outbound bandwidth associated with the attachment download route.

Detection Strategies

Query the FreeScout database for records where token_type = 1 and correlate access log entries against those attachment IDs.
Alert on HTTP 200 responses from the attachment download endpoint where the request lacks a valid token parameter.
Baseline normal attachment access rates per source IP and flag deviations.

Monitoring Recommendations

Enable verbose access logging on the reverse proxy fronting FreeScout and forward logs to a central analytics pipeline.
Monitor for scanner user agents and rapid ID enumeration against /attachment/ routes.
Review authentication and session events for anomalous attachment retrieval outside normal helpdesk workflows.

How to Mitigate CVE-2026-48812

Immediate Actions Required

Upgrade FreeScout to version 1.8.221 or later without delay.
Restrict public network exposure of the FreeScout instance to trusted networks or a VPN until the upgrade is verified.
Audit access logs for prior unauthenticated attachment downloads and notify affected parties if sensitive data was exposed.

Patch Information

The fix is delivered in FreeScout 1.8.221. The patch removes the TOKEN_TYPE_LEGACY constant usage in app/Attachment.php and eliminates the legacy bypass branch in OpenController.php, requiring a valid token for every attachment download. See the GitHub Security Advisory GHSA-wg74-ww4w-2qpc and the remediation commit.

Workarounds

Place the FreeScout attachment routes behind an authenticated reverse proxy or web application firewall rule that blocks requests missing a valid token parameter.
Rotate or invalidate legacy attachment URLs by regenerating tokens on stored attachments once the upgrade is applied.
Temporarily disable the public attachment download route in web server configuration if immediate patching is not possible.

bash

# Example nginx rule to block token-less attachment requests until patched
location ~ ^/attachment/download/ {
    if ($arg_token = "") {
        return 403;
    }
    proxy_pass http://freescout_upstream;
}