CVE-2026-45295: FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/{conversationid}/{threadid} allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (openedat timestamp) without any authentication. Version 1.8.219 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeScoutto a version that resolves this vulnerability.Fixed in 1.8.219
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45295?
CVE-2026-45295 has a medium severity score of 6.5.
What vulnerabilities exist in CVE-2026-45295?
CVE-2026-45295 allows unauthenticated attackers to manipulate thread read-status and enumerate conversation IDs via an open tracking endpoint.
How do I fix CVE-2026-45295?
To fix CVE-2026-45295, upgrade FreeScout to version 1.8.219 or later.
What type of attack does CVE-2026-45295 permit?
CVE-2026-45295 permits unauthenticated enumeration of valid conversation and thread IDs by attackers.
Is user authentication required to exploit CVE-2026-45295?
No, CVE-2026-45295 can be exploited without user authentication.