CVE-2026-53592 Details
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/main.js` and was addressed in version 1.8.139 by blocking URL query keys matching the pattern `__proto__`. However, this mitigation is incomplete: it only filters top-level `__proto__` keys and fails to sanitize nested forms such as `b[__proto__][polluted]=PWNED`. As a result, an attacker-controlled URL query string can still write into `Object.prototype` on any page that loads `main.js`. Version 1.8.223 contains a updated fix.
A prototype pollution vulnerability has been identified in FreeScout, a help desk application built on PHP's Laravel framework. The issue arises in the 'getQueryParam' function within 'public/js/main.js'. Although a partial mitigation was implemented in version 1.8.139 to block top-level '__proto__' keys, this fix is incomplete. It fails to sanitize nested query parameters, allowing an attacker to manipulate 'Object.prototype' on any page that loads 'main.js'. This vulnerability affects FreeScout versions prior to 1.8.223.
Users are advised to update FreeScout to version 1.8.223 or later, where this vulnerability has been properly fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w5fc-8pp3-f755 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w5fc-8pp3-f755 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FreeScout | < 1.8.223 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |