CVE-2026-45295: FreeScout Auth Bypass Vulnerability

CVE-2026-45295 Overview

FreeScout is a free help desk and shared inbox application built on PHP's Laravel framework. CVE-2026-45295 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the open tracking endpoint GET /thread/read/{conversation_id}/{thread_id}. The endpoint accepts requests without authentication and permits attackers to enumerate valid conversation and thread identifiers. Successful requests also modify the thread state by updating the opened_at timestamp. The issue affects FreeScout versions prior to 1.8.219 and is remediated in version 1.8.219.

Critical Impact
Unauthenticated attackers can enumerate internal conversation and thread IDs and tamper with message read-state metadata over the network without user interaction.

Affected Products

FreeScout help desk application, all versions prior to 1.8.219
Deployments exposing the /thread/read/ open tracking endpoint to untrusted networks
Self-hosted PHP/Laravel-based FreeScout installations

Discovery Timeline

2026-07-20 - CVE-2026-45295 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-45295

Vulnerability Analysis

The vulnerability resides in the email open-tracking route GET /thread/read/{conversation_id}/{thread_id}. This endpoint is designed to record when a recipient opens an email by loading a tracking pixel. FreeScout serves the endpoint without any authentication or capability check on the caller. The route also lacks an unpredictable, cryptographically strong token bound to the specific thread. As a result, any anonymous network client that can reach the application can invoke the endpoint with arbitrary integer identifiers.

Two direct consequences follow. First, attackers can enumerate the identifier space to determine which conversation_id and thread_id combinations exist based on server responses. Second, each valid request writes to the database, updating the opened_at timestamp of the targeted thread. This corrupts open-tracking analytics and can mislead support agents about customer engagement.

Root Cause

The root cause is a missing authorization check on a state-changing endpoint, classified as Authorization Bypass Through User-Controlled Key [CWE-639]. The identifiers passed in the URL are sequential and guessable, and the handler performs no ownership or session validation before executing the update.

Attack Vector

Exploitation requires only network access to the FreeScout web interface. An attacker iterates over integer values for conversation_id and thread_id in HTTP GET requests to /thread/read/{conversation_id}/{thread_id}. Response differentials disclose valid identifier pairs, and each valid request silently mutates thread state. No credentials, tokens, or user interaction are needed. The Exploit Prediction Scoring System (EPSS) currently reports a low probability of observed exploitation.

No verified public exploit code is available. See the GitHub Security Advisory for the maintainer's technical description.

Detection Methods for CVE-2026-45295

Indicators of Compromise

High-volume sequential HTTP GET requests to the /thread/read/{conversation_id}/{thread_id} path from a single source address
Unexpected updates to the opened_at column in the FreeScout threads table for messages that were never delivered or opened by recipients
Access log entries for the tracking endpoint originating from IP addresses outside normal recipient geographies

Detection Strategies

Parse web server access logs for repeated requests to /thread/read/ with monotonically increasing path parameters, which indicate enumeration
Alert on requests to the open-tracking endpoint that lack a corresponding outbound email send event in the FreeScout audit trail
Compare the ratio of tracking pixel hits to actual sent messages and flag deviations that exceed a defined baseline

Monitoring Recommendations

Ingest FreeScout Nginx or Apache access logs into a centralized log platform and build queries against the /thread/read/ route
Track database change events on the threads.opened_at column to correlate write activity with authenticated user sessions
Rate-limit anonymous access to tracking endpoints at the reverse proxy layer and alert on threshold breaches

How to Mitigate CVE-2026-45295

Immediate Actions Required

Upgrade all FreeScout instances to version 1.8.219 or later, which contains the vendor patch
Audit access logs for prior enumeration activity against /thread/read/ and validate the integrity of open-tracking data
Restrict administrative and internal FreeScout endpoints to trusted networks or VPN clients where feasible

Patch Information

The FreeScout maintainers released version 1.8.219, which addresses the missing authorization control on the open tracking endpoint. Refer to the GitHub Security Advisory GHSA-qjr9-6v9q-3r72 for release notes and upgrade instructions. Apply the upgrade through the standard FreeScout update procedure and verify the version string after deployment.

Workarounds

If immediate patching is not possible, block or rate-limit external requests to /thread/read/ at the reverse proxy or web application firewall
Restore or recompute opened_at values from mail transfer logs if analytics integrity is required
Place the FreeScout admin interface behind an authenticated reverse proxy such as an SSO gateway until the patch is applied

bash

# Nginx snippet to restrict anonymous access to the open tracking endpoint
location ~ ^/thread/read/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://freescout_backend;
}