CVE-2026-45295
Received Received - Intake

Open Tracking ID Enumeration in FreeScout

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conversation_id}/{thread_id}` allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (`opened_at` timestamp) without any authentication. Version 1.8.219 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-45295
EUVD
EUVD-2026-46043

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freescout freescout to 1.8.219 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FreeScout versions before 1.8.219 allows unauthenticated attackers to access an endpoint that should require authentication. The endpoint /thread/read/{conversation_id}/{thread_id} lets attackers guess valid conversation and thread IDs by checking HTTP response differences. Valid IDs return a 200 status with a GIF, while invalid ones return a 404 error. It also lets attackers modify the opened_at timestamp, corrupting email read-tracking data.

Detection Guidance

To detect this vulnerability, monitor HTTP responses from the `/thread/read/{conversation_id}/{thread_id}` endpoint. Valid pairs return HTTP 200 with a GIF, while invalid pairs return HTTP 404. Use tools like curl to test random IDs and observe response codes. Example: curl -I http://target.com/thread/read/123/456

Check database logs for unexpected modifications to the `opened_at` timestamp in the threads table, which may indicate exploitation.

Impact Analysis

Attackers could enumerate all conversation and thread IDs, exposing sensitive email metadata. They could also manipulate read status tracking, making it appear emails were read when they were not. This could lead to missed important communications or privacy violations.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data through ID enumeration and compromising email tracking integrity. For HIPAA, it may risk protected health information confidentiality by allowing unauthorized access to communication metadata.

Mitigation Strategies

Upgrade FreeScout to version 1.8.219 or later immediately to patch the vulnerability. If upgrading is not possible, restrict access to the `/thread/read` endpoint via web server rules or firewall until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45295. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart