CVE-2026-45295 in FreeScout
Summary
by MITRE • 07/20/2026
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conversation_id}/{thread_id}` allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (`opened_at` timestamp) without any authentication. Version 1.8.219 patches the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in FreeScout affects versions prior to 1.8.219 and stems from inadequate access controls within the open tracking endpoint. This flaw exists at the application level where the GET /thread/read/{conversation_id}/{thread_id} endpoint fails to properly authenticate or authorize requests, allowing any unauthenticated attacker to probe the system for valid conversation and thread identifiers. The vulnerability represents a classic case of insufficient authorization as defined by CWE-285, where the application does not adequately verify that users have proper permissions before granting access to resources.
The technical implementation of this flaw enables attackers to perform enumeration attacks against conversation and thread IDs, which can reveal information about the system's internal structure and potentially expose sensitive data. By simply making GET requests to the endpoint with various parameter combinations, an attacker can determine which conversation and thread identifiers are valid within the system. This enumeration capability extends beyond simple identification to include manipulation of thread state through modification of the opened_at timestamp field. The ability to alter timestamp values without authentication creates opportunities for data integrity violations and potential disruption of workflow processes.
The operational impact of this vulnerability extends across multiple security domains including information disclosure, access control bypass, and data manipulation. Attackers can leverage this flaw to map out the complete conversation and thread structure of the help desk system, potentially identifying sensitive customer interactions or internal communications. The timestamp modification capability allows for timeline manipulation that could affect audit trails and forensic analysis. This vulnerability aligns with ATT&CK technique T1566 for credential harvesting through phishing attacks and T1078 for valid accounts usage, as it enables unauthorized access to system resources without proper authentication.
Security controls that should have been implemented include proper authentication checks using Laravel's built-in middleware, authorization gates, or policy-based access control mechanisms. The framework's inherent security features such as CSRF protection and route-level middleware should have been enforced on the vulnerable endpoint. Organizations should implement rate limiting and logging for all endpoint access attempts to detect enumeration activities. The patch released in version 1.8.219 addresses this by enforcing proper authentication requirements before allowing access to thread and conversation data, thereby closing the gap that allowed unauthenticated exploitation of the system's internal resource identifiers.
This vulnerability highlights the importance of secure coding practices within PHP applications built on frameworks like Laravel where default security mechanisms may be bypassed through improper implementation. The flaw demonstrates how seemingly minor access control oversights can result in significant information disclosure risks and operational disruption. Organizations using FreeScout should ensure they are running patched versions and review their application's endpoint security configurations to prevent similar issues in other components of their software stack. The vulnerability serves as a reminder that even free and open-source applications require regular security updates and proper configuration management to maintain effective defense-in-depth strategies.