CVE-2026-45294: FreeScout: User Account Enumeration via Password Reset Response Differentiation
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeScoutto a version that resolves this vulnerability.Fixed in 1.8.219
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45294?
CVE-2026-45294 has a medium severity rating of 5.3.
How do I fix CVE-2026-45294?
To mitigate CVE-2026-45294, upgrade FreeScout to version 1.8.219 or later.
What type of attack does CVE-2026-45294 allow?
CVE-2026-45294 allows unauthenticated attackers to perform user account enumeration via the password reset responses.
What is FreeScout?
FreeScout is a free help desk and shared inbox application built with PHP's Laravel framework.
What is the impact of CVE-2026-45294?
The impact of CVE-2026-45294 is that it enables attackers to determine valid email addresses associated with user accounts.