{"id":"EM-20261109-E7OC","url":"https://cyber.eventmonitor.net/incident/EM-20261109-E7OC/freescout-vulnerability-cve-2026-62856/","type":"cve","title":"FreeScout Vulnerability (CVE-2026-62856)","subtitle":"CVE-2026-62856","subject":"CVE-2026-62856","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-09T00:00:00.000Z","firstSignal":"2026-11-06T17:18:34.047Z","lastSignal":"2026-11-09T00:00:00.000Z","updated":"2026-11-09T11:36:41.853Z","revision":1,"life":[{"status":"Born","at":"2026-11-09T00:00:00.000Z","why":"second independent source: C30 VulnCheck KEV"},{"status":"Developing","at":"2026-11-09T00:00:00.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-06T17:18:34.047Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-09T00:00:00.000Z","what":"Born: second source, C30 VulnCheck KEV. Page EM-20261109-E7OC created."}],"stages":[{"name":"Disclosed","at":"2026-11-06T17:18:34.047Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-06T17:18:34.047Z","detail":"CVSS 7.7 · EPSS 0.3%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-06T17:18:34.047Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-62856 (CVSS 7.7)","text":"FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the  polycast/receive  endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62856"},{"at":"2026-11-09T00:00:00.000Z","source":"C30","sourceName":"VulnCheck KEV","role":"Research & News","severity":3,"title":"CVE-2026-62856 known exploited (VulnCheck KEV): freescout freescout Improper Neutralization of Special Elements used in an SQL Command","text":"FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the  polycast/receive  endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a…","url":"https://vulncheck.com/browse/cve/CVE-2026-62856"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-06T17:18:34.047","score":7.7,"severity":"HIGH","desc":"FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the  polycast/receive  endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a…","product":"","seen":1793992931551},"kev":null,"epss":{"epss":0.00256,"pct":0.17402,"at":1794224201853},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}