Compliance Impact

The vulnerability allows unauthenticated attackers to access and manipulate thread read statuses and timestamps, as well as enumerate valid thread IDs. This unauthorized access and modification of data could lead to violations of data protection principles such as confidentiality and integrity.

Such unauthorized access and data manipulation may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information against unauthorized access and ensure data integrity.

However, the provided information does not explicitly state the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-35584 is an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability in FreeScout's GET endpoint /thread/read/{conversation_id}/{thread_id} prior to version 1.8.212.

This endpoint does not require authentication and fails to verify that the provided thread_id belongs to the specified conversation_id.

As a result, an attacker can mark any thread as read by supplying arbitrary conversation and thread IDs, enumerate valid thread IDs by observing HTTP response codes (200 for valid, 404 for invalid), and manipulate the opened_at timestamps of threads across different conversations.

This breaks the intended conversation isolation and can mislead support agents relying on these metrics.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker to:

• Mark any thread as read without authorization.
• Enumerate valid thread IDs by analyzing HTTP response codes.
• Manipulate the opened_at timestamps of threads across conversations, breaking conversation boundaries.

These impacts can lead to unauthorized access and modification of thread statuses, potentially misleading support agents and compromising the integrity of conversation data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending unauthenticated HTTP GET requests to the endpoint /thread/read/{conversation_id}/{thread_id} with arbitrary conversation_id and thread_id values.

By observing the HTTP response codes, you can enumerate valid thread IDs: a 200 OK response indicates a valid thread, while a 404 Not Found indicates an invalid thread.

For example, you can use curl commands to test the endpoint without authentication.

• curl -i http://your-freescout-instance/thread/read/1/3
• Check if the response status is 200, which means the thread ID 3 exists and can be accessed without authentication.

If the thread_id does not belong to the conversation_id but still returns 200, it confirms the vulnerability allowing unauthorized access and manipulation.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade FreeScout to version 1.8.212 or later, where this vulnerability is fixed.

The fix involves enforcing validation on the endpoint to ensure that the thread_id belongs to the specified conversation_id and aborting the request with a 403 Forbidden status if it does not.

If upgrading immediately is not possible, consider implementing access controls or network restrictions to limit unauthenticated access to the vulnerable endpoint.

Useful 0 Not Useful 0