CVE-2026-45295

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/{conversation_id}/{thread_id} allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (opened_at timestamp) without any authentication. Version 1.8.219 patches the issue.