# CVE-2026-48812: FreeScout improper authentication in attachment download route

Source: https://junglewise.ai/threats/cve-2026-48812-freescout-improper-authentication-in-attachment-download-route  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-48812 · Severity: high · CVSS 7.5 · Published 2026-07-20

FreeScout is an open-source help desk and shared inbox platform used by businesses to manage customer support communications. A security flaw allows unauthorized individuals to download email attachments without logging in or providing a valid security token. This could lead to the exposure of sensitive customer data, such as contracts, invoices, or personal documents, if they were uploaded using older versions of the software.

## Quick answers

**Is CVE-2026-48812 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48812 being exploited in the wild.

**How severe is CVE-2026-48812?** High severity, with a CVSS score of 7.5, published 20 July 2026.

**Which products and versions are affected?** freescout-help-desk FreeScout < 1.8.221.

**Is there a fix for CVE-2026-48812?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48812 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48812?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logical flaw exists in the `downloadAttachment` method within `app/Http/Controllers/OpenController.php`. The code explicitly skips token validation if an attachment's `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because the attachment download route is registered without authentication middleware and file storage paths are computed deterministically based on the attachment's database ID, an attacker can enumerate IDs to derive paths and download legacy files. This affects installations upgraded from older versions where legacy tokens are still present in the database. The vulnerability is addressed in version 1.8.221 by removing the legacy bypass.

## Affected products

- freescout-help-desk FreeScout < 1.8.221

## Timeline

- 2026-06-01: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD

## References

- [https://github.com/freescout-help-desk/freescout/commit/215241ee2eb73eaa3b47e392599c7dc1b427dc7e](https://github.com/freescout-help-desk/freescout/commit/215241ee2eb73eaa3b47e392599c7dc1b427dc7e)
- [https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg74-ww4w-2qpc](https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-wg74-ww4w-2qpc)