Password Reset User Enumeration in FreeScout

Compliance Impact

This vulnerability allows unauthenticated attackers to enumerate valid helpdesk agent email addresses by observing distinct responses from the password reset endpoint. Such information disclosure can facilitate targeted phishing attacks or agent impersonation.

While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, the exposure of valid email addresses could be considered a data privacy concern under these regulations, as it involves unauthorized disclosure of personal information.

Therefore, organizations using affected versions of FreeScout may face increased risk of non-compliance with data protection requirements that mandate safeguarding personal data against unauthorized access or disclosure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to enumerate valid helpdesk agent email addresses without authentication.

With this information, attackers could perform targeted phishing attacks against those agents or use the enumerated emails as a stepping stone for further attacks such as agent impersonation.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-45294 is a vulnerability in FreeScout Help Desk software versions prior to 1.8.219. It occurs because the password reset endpoint returns different visible responses depending on whether the submitted email address belongs to an existing user account or not.

Specifically, when a password reset request is made, the system shows a success message with a certain CSS class if the email exists, and an error message with a different CSS class if it does not. This difference in responses allows unauthenticated attackers to determine which email addresses are valid helpdesk agent accounts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by submitting password reset requests with different email addresses and observing the responses. If the responses differ visually or in content depending on whether the email exists in the system, the system is vulnerable to user enumeration.

For example, you can use curl commands to test the password reset endpoint with existing and non-existing email addresses and compare the responses.

• curl -X POST -d '[email protected]' https://your-freescout-instance/password-reset
• curl -X POST -d '[email protected]' https://your-freescout-instance/password-reset

If the responses contain different CSS classes or messages indicating success or error depending on the email validity, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation steps include upgrading FreeScout to version 1.8.219 or later, where this vulnerability is fixed.

Additionally, ensure that the password reset endpoint returns identical responses regardless of whether the submitted email exists in the system to prevent user enumeration.

Implement rate limiting on the password reset endpoint to reduce the risk of automated enumeration attacks.

Useful 0 Not Useful 0