CVE-2026-35584 Details
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate opened_at timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.
A vulnerability exists in FreeScout versions prior to 1.8.212, specifically in the thread tracking endpoint GET /thread/read/{conversation_id}/{thread_id}. This endpoint lacks authentication and fails to verify whether the thread_id corresponds to the specified conversation_id. As a result, an unauthenticated attacker can mark threads as read by using arbitrary IDs, enumerate valid thread IDs through HTTP response codes, and manipulate opened_at timestamps across different conversations, leading to an Insecure Direct Object Reference (IDOR) vulnerability.
Users are advised to update FreeScout to version 1.8.212 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-873c-r7v5-g98v | CISA-ADP | ExploitVendor Advisory |
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-873c-r7v5-g98v | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freescout freescout | < 1.8.212 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | New CVE Received | [email protected] |