# FreeScout vulnerabilities Source: https://junglewise.ai/threats/vendors/freescout Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/freescout.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in FreeScout: 11 in the last 7 days and 12 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-85742, was published on 6 November 2026. 11 vulnerabilities in the last four weeks, up 1000% on the four before (1). 1 technology has a page of its own. ## Counts - Last 7 days: 11 - Last 30 days: 11 - Last 90 days: 12 - All time: 20 (2 critical, 0 exploited in the wild) ## About FreeScout FreeScout is an open-source help desk and customer support platform. ## Latest FreeScout vulnerabilities - [CVE-2026-85742: FreeScout stored XSS in job details page](https://junglewise.ai/threats/cve-2026-85742-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (high, CVSS 7.5, published 6 Nov 2026) - [CVE-2026-85744: FreeScout authorization bypass in conversation merge](https://junglewise.ai/threats/cve-2026-85744-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-85743: FreeScout SSRF in remote download and port check](https://junglewise.ai/threats/cve-2026-85743-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (high, CVSS 8.2, published 6 Nov 2026) - [CVE-2026-62856: FreeScout SQL injection in polycast receive endpoint](https://junglewise.ai/threats/cve-2026-62856-freescout-is-a-self-hosted-help-desk-and-shared-mailbox) (high, CVSS 7.7, published 6 Nov 2026) - [CVE-2026-62855: FreeScout path traversal in App Logs viewer](https://junglewise.ai/threats/cve-2026-62855-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (medium, CVSS 4.4, published 6 Nov 2026) - [CVE-2026-62854: FreeScout stored XSS in mailbox signature via nested tag bypass](https://junglewise.ai/threats/cve-2026-62854-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (high, CVSS 7.6, published 6 Nov 2026) - [CVE-2026-62852: FreeScout authorization bypass in RealtimeConvNewThread](https://junglewise.ai/threats/cve-2026-62852-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-62851: FreeScout conversation search access control bypass](https://junglewise.ai/threats/cve-2026-62851-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (medium, CVSS 4.3, published 6 Nov 2026) - [CVE-2026-62850: FreeScout tools.php authentication bypass and credential enumeration](https://junglewise.ai/threats/cve-2026-62850-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (medium, CVSS 5.3, published 6 Nov 2026) - [CVE-2026-103985: FreeScout privilege escalation in profile form](https://junglewise.ai/threats/cve-2026-103985-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (high, CVSS 7.1, published 6 Nov 2026) - [CVE-2026-103984: FreeScout authorization bypass in load_customer_info](https://junglewise.ai/threats/cve-2026-103984-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-107393: FreeScout stored XSS in admin alert email via spoofed CF-Connecting-IP](https://junglewise.ai/threats/cve-2026-107393-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (medium, CVSS 6.1, published 8 Oct 2026) - [CVE-2026-48811: FreeScout missing authorization in internal note deletion](https://junglewise.ai/threats/cve-2026-48811-freescout-missing-authorization-in-internal-note-deletion) (medium, CVSS 4.3, published 29 May 2026) - [CVE-2026-48810: FreeScout improper authorization in ThreadPolicy edit method](https://junglewise.ai/threats/cve-2026-48810-freescout-improper-authorization-in-threadpolicy-edit-method) (medium, CVSS 4.3, published 29 May 2026) - [CVE-2026-47123: FreeScout agent impersonation via missing HMAC in notification replies](https://junglewise.ai/threats/cve-2026-47123-freescout-agent-impersonation-via-missing-hmac-in-notification) (high, CVSS 7.5, published 29 May 2026) - [CVE-2026-45294: FreeScout account enumeration in password reset endpoint](https://junglewise.ai/threats/cve-2026-45294-freescout-account-enumeration-in-password-reset-endpoint) (medium, CVSS 5.3, published 29 May 2026) - [CVE-2026-40565: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function…](https://junglewise.ai/threats/cve-2026-40565-freescout-is-a-free-self-hosted-help-desk-and-shared-mailbox) (medium, CVSS 6.1, published 21 Apr 2026) - [CVE-2026-40498: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker…](https://junglewise.ai/threats/cve-2026-40498-freescout-is-a-free-self-hosted-help-desk-and-shared-mailbox) (critical, CVSS 9.8, published 21 Apr 2026) - [CVE-2026-40497: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's…](https://junglewise.ai/threats/cve-2026-40497-freescout-is-a-free-self-hosted-help-desk-and-shared-mailbox) (high, CVSS 8.1, published 21 Apr 2026) - [CVE-2026-40496: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are…](https://junglewise.ai/threats/cve-2026-40496-freescout-is-a-free-self-hosted-help-desk-and-shared-mailbox) (critical, CVSS 9.1, published 21 Apr 2026) ## Most severe FreeScout vulnerabilities - [CVE-2026-40498: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker…](https://junglewise.ai/threats/cve-2026-40498-freescout-is-a-free-self-hosted-help-desk-and-shared-mailbox) (critical, CVSS 9.8, published 21 Apr 2026) - [CVE-2026-40496: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are…](https://junglewise.ai/threats/cve-2026-40496-freescout-is-a-free-self-hosted-help-desk-and-shared-mailbox) (critical, CVSS 9.1, published 21 Apr 2026) - [CVE-2026-85743: FreeScout SSRF in remote download and port check](https://junglewise.ai/threats/cve-2026-85743-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (high, CVSS 8.2, published 6 Nov 2026) - [CVE-2026-40497: FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's…](https://junglewise.ai/threats/cve-2026-40497-freescout-is-a-free-self-hosted-help-desk-and-shared-mailbox) (high, CVSS 8.1, published 21 Apr 2026) - [CVE-2026-62856: FreeScout SQL injection in polycast receive endpoint](https://junglewise.ai/threats/cve-2026-62856-freescout-is-a-self-hosted-help-desk-and-shared-mailbox) (high, CVSS 7.7, published 6 Nov 2026) - [CVE-2026-62854: FreeScout stored XSS in mailbox signature via nested tag bypass](https://junglewise.ai/threats/cve-2026-62854-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (high, CVSS 7.6, published 6 Nov 2026) - [CVE-2026-85742: FreeScout stored XSS in job details page](https://junglewise.ai/threats/cve-2026-85742-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (high, CVSS 7.5, published 6 Nov 2026) - [CVE-2026-47123: FreeScout agent impersonation via missing HMAC in notification replies](https://junglewise.ai/threats/cve-2026-47123-freescout-agent-impersonation-via-missing-hmac-in-notification) (high, CVSS 7.5, published 29 May 2026) - [CVE-2026-103985: FreeScout privilege escalation in profile form](https://junglewise.ai/threats/cve-2026-103985-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (high, CVSS 7.1, published 6 Nov 2026) - [CVE-2026-62852: FreeScout authorization bypass in RealtimeConvNewThread](https://junglewise.ai/threats/cve-2026-62852-freescout-is-a-self-hosted-help-desk-and-shared-mailbox-prior-to) (medium, CVSS 6.5, published 6 Nov 2026) ## Vulnerabilities per week 11 vulnerabilities in the last four weeks, up 1000% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 11 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## FreeScout technologies - [FreeScout](https://junglewise.ai/threats/technologies/freescout-freescout): 16 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "FreeScout vulnerabilities", https://junglewise.ai/threats/vendors/freescout, 12 November 2026.