PT-2026-30895 · Freescout+1 · Freescout+1

Spoo1K · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-35584

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.212

Description FreeScout, a help desk and shared inbox built with Laravel, is affected by an issue where the GET /thread/read/{conversation id}/{thread id} API endpoint does not require authentication and lacks validation to ensure the thread id belongs to the specified conversation id. This allows an unauthenticated attacker to mark any thread as read using arbitrary IDs, enumerate valid thread IDs through HTTP response codes (200 vs 404), and manipulate opened at timestamps across conversations. This is an IDOR (Insecure Direct Object Reference) issue.

Recommendations Upgrade to FreeScout version 1.8.212 or later.

Exploit

Fix

Missing Authentication

IDOR

Weakness Enumeration

CWE-306

CWE-639

Related Identifiers

CVE-2026-35584

Affected Products

Freescout

Laravel

References · 4

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-873c-r7v5-g98v · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35584 · Security Note
• https://twitter.com/infoflowcloud/status/2041570806187065582 · Twitter Post
• https://twitter.com/CVEnew/status/2041569999136158089 · Twitter Post