PT-2026-61666 · Freescout · Freescout

CVE-2026-45295 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.219

Description An issue exists in the open tracking endpoint GET /thread/read/{conversation id}/{thread id} that allows unauthenticated attackers to enumerate valid conversation and thread IDs. Additionally, this allows the modification of the thread state, specifically the opened at timestamp, without requiring authentication.

Recommendations Update to version 1.8.219.

Exploit

Fix

Missing Authorization

IDOR

Weakness Enumeration

CWE-862

CWE-639

Related Identifiers

CVE-2026-45295

GHSA-QJR9-6V9Q-3R72

Affected Products

Freescout

References · 5

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-qjr9-6v9q-3r72 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45295.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-45295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45295 · Security Note
• https://twitter.com/VulmonFeeds/status/2079373622418788746 · Twitter Post