CVE-2026-35584: FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversationid}/{threadid} does not require authentication and does not validate whether the given threadid belongs to the given conversationid. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate openedat timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35584?
CVE-2026-35584 is considered a high severity vulnerability due to its potential for unauthenticated access and manipulation of threaded conversations.
How do I fix CVE-2026-35584?
To mitigate CVE-2026-35584, upgrade FreeScout to version 1.8.212 or later, where the vulnerability has been addressed.
What systems are affected by CVE-2026-35584?
CVE-2026-35584 affects FreeScout versions prior to 1.8.212.
What type of vulnerability is CVE-2026-35584?
CVE-2026-35584 is an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability.
Can CVE-2026-35584 lead to data leakage?
Yes, CVE-2026-35584 allows for cross-conversation thread manipulation, which can lead to data leakage and enumeration of conversation threads.