VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Apr 7, 2026· Updated Apr 16, 2026

CVE-2026-35584

CVE-2026-35584

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate opened_at timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Freescout/Freescout2 versions
    cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*range: <1.8.212
    • (no CPE)range: <1.8.212

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.