FreeScout, a PHP-based help desk system, contains an access control flaw that lets an unauthenticated attacker retrieve attachments marked as legacy. The flaw stems from the attachment download route skipping token authentication for files whose token_type is set to 1 (TOKEN_TYPE_LEGACY). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. This leads to disclosure of possibly sensitive documents, violating confidentiality and potentially exposing personal data or internal communications, and is an example of CWE‑287 (Improper Authentication).

The vulnerability exists in all FreeScout installations built with versions earlier than 1.8.221. The affected product is FreeScout Help Desk. The fix is delivered in version 1.8.221 and later releases.

The CVSS score of 7.5 indicates high severity, and the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote unauthenticated, leveraging the publicly exposed download endpoint and deterministic file paths.