CVE-2026-35584: FreeScout Auth Bypass Vulnerability

CVE-2026-35584 Overview

FreeScout, a free open-source help desk and shared inbox built with PHP's Laravel framework, contains an Insecure Direct Object Reference (IDOR) vulnerability combined with missing authentication in versions prior to 1.8.212. The vulnerable endpoint GET /thread/read/{conversation_id}/{thread_id} lacks authentication requirements and fails to validate whether the provided thread_id belongs to the specified conversation_id. This flaw enables unauthenticated attackers to manipulate thread states and enumerate valid identifiers within the help desk system.

Critical Impact

Unauthenticated attackers can mark any thread as read, enumerate valid thread IDs through HTTP response code analysis (200 vs 404), and manipulate opened_at timestamps across conversations, potentially disrupting help desk operations and exposing internal conversation metadata.

Affected Products

• FreeScout Help Desk versions prior to 1.8.212
• Self-hosted FreeScout installations with exposed /thread/read/ endpoints
• Laravel-based deployments with default routing configurations

Discovery Timeline

• 2026-04-07 - CVE-2026-35584 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-35584

Vulnerability Analysis

This vulnerability stems from Missing Authentication for Critical Function (CWE-306) in FreeScout's thread management endpoint. The application fails to implement proper authentication checks on the /thread/read/{conversation_id}/{thread_id} endpoint, allowing any external actor to interact with the API without credentials. Furthermore, the endpoint does not validate the relationship between the conversation_id and thread_id parameters, creating a classic IDOR condition.

The vulnerability is exploitable over the network without any user interaction or prior authentication required. An attacker can leverage this flaw to systematically enumerate valid thread identifiers by observing HTTP response codes—receiving a 200 status for valid IDs and 404 for invalid ones. This enumeration capability could reveal the volume and activity patterns of a help desk system, potentially aiding in further targeted attacks.

Root Cause

The root cause lies in the missing authentication middleware on the thread read endpoint combined with insufficient authorization checks. The Laravel controller handling this route does not verify user session or API token authentication before processing requests. Additionally, the business logic fails to confirm that the requested thread_id actually belongs to the specified conversation_id, violating the principle of proper object-level authorization.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft HTTP GET requests directly to the vulnerable endpoint with arbitrary conversation and thread IDs. By iterating through numeric identifiers, the attacker can discover valid thread IDs through response code differentiation. Once valid IDs are identified, the attacker can mark threads as read, potentially disrupting workflow indicators that help desk agents rely on to prioritize support tickets.

The exploitation process involves sending unauthenticated GET requests to /thread/read/{conversation_id}/{thread_id} with varying parameter values. A 200 response indicates a valid thread that has been marked as read, while a 404 indicates an invalid identifier. This binary response pattern facilitates efficient enumeration attacks against the help desk infrastructure.

Detection Methods for CVE-2026-35584

Indicators of Compromise

• Unusual volumes of HTTP GET requests to /thread/read/ endpoints from external IP addresses
• Sequential or pattern-based enumeration of conversation_id and thread_id parameters in access logs
• Threads marked as read without corresponding authenticated user sessions
• Anomalous opened_at timestamp modifications without legitimate user activity

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block sequential ID enumeration patterns on the /thread/read/ endpoint
• Monitor access logs for unauthenticated requests to sensitive thread management endpoints
• Configure intrusion detection systems (IDS) to alert on high-frequency requests to the vulnerable URL pattern
• Deploy rate limiting on the /thread/read/ endpoint to throttle enumeration attempts

Monitoring Recommendations

• Enable detailed access logging for all FreeScout thread management endpoints
• Set up alerts for requests to /thread/read/ without valid authentication cookies or tokens
• Monitor for statistically significant changes in thread read patterns that don't correlate with support agent activity
• Review server logs regularly for evidence of ID enumeration attack patterns

How to Mitigate CVE-2026-35584

Immediate Actions Required

• Upgrade FreeScout to version 1.8.212 or later immediately to apply the security patch
• Implement network-level access controls to restrict access to FreeScout endpoints from untrusted networks
• Deploy a web application firewall with rules to block unauthenticated access to /thread/read/ endpoints
• Review access logs for evidence of prior exploitation and investigate any suspicious activity

Patch Information

The vulnerability has been addressed in FreeScout version 1.8.212. Organizations should update to this version or later to remediate the vulnerability. The fix implements proper authentication checks on the vulnerable endpoint and validates the relationship between conversation_id and thread_id parameters before processing requests. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Configure web server rules (Apache/Nginx) to require authentication for all requests to /thread/read/ paths as a temporary measure
• Implement IP-based access restrictions to limit FreeScout access to trusted networks only
• Deploy a reverse proxy with authentication requirements in front of FreeScout until the patch can be applied
• Consider disabling the vulnerable endpoint entirely if thread read functionality is not critical to operations

# Nginx configuration to require authentication for vulnerable endpoint
location ~* ^/thread/read/ {
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://freescout_backend;
}