Freescout CVE-2026-35584

This vulnerability presents elevated real-world risk despite a CVSS 6.9 score. The attack vector is network-based with low complexity and no authentication requirement (PR:N per vector), making exploitation trivial for any attacker. The CVSS vector shows limited impact scope (VC:L, VI:L, VA:N), but the practical threat is substantial: an attacker gains visibility into all help desk conversations and can perform reconnaissance via enumeration without triggering authentication logs. The CWE-306 classification (missing authentication for critical function) combined with IDOR creates a critical confidentiality leak in a system handling sensitive customer support data. No exploitation probability score (EPSS) or KEV status provided, but the low attack complexity and high accessibility make this immediately exploitable. The vulnerability represents a foundational auth bypass rather than a complex design flaw, increasing likelihood of exploitation by script-kiddies and automated scanners.

An unauthenticated attacker sends requests to GET /thread/read/1/1, /thread/read/1/2, etc., observing HTTP response codes to map valid thread IDs across conversations. Once thread IDs are enumerated, the attacker can access any thread's content via the same endpoint without logging in, and modify opened_at metadata by triggering the read action. This allows espionage on customer support conversations, extraction of sensitive data shared in tickets, and defacement of internal ticket audit trails-all without credentials or detection.