CVE-2026-53596

Received Received - Intake

Rate Limiting Bypass in FreeScout Helpdesk

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-53596

Affected Vendors & Products

Vendor	Product	Version / Range
freescout	freescout	to 1.8.224 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in FreeScout, a help desk application. It allows any user to repeatedly upload files without rate limits, overwhelming the server's database and causing service disruption for all users.

Detection Guidance

Monitor for unusually high numbers of file upload requests to the FreeScout endpoint. Check server logs for repeated POST requests to upload-related paths. High database query loads without corresponding user activity may indicate exploitation.

Impact Analysis

If exploited, this vulnerability could make the FreeScout application unresponsive or crash due to database overload. This would disrupt access for all users, including administrators and customers, potentially halting support operations.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial of service attacks that disrupt service availability. GDPR requires data controllers to ensure availability of personal data, while HIPAA mandates timely access to protected health information. A DoS condition may violate these requirements.

Mitigation Strategies

Upgrade FreeScout to version 1.8.224 or later. Implement rate limiting on the file upload endpoint. Restrict upload permissions if possible. Monitor server performance and database load for signs of ongoing attacks.

Hi! I’m here to help you understand CVE-2026-53596. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70