Is there a patch available for CVE-2026-35584?

Yes, a patch is available for CVE-2026-35584. Update the affected software to the latest version immediately.

Freescout CVE-2026-35584

Q: What is the CVSS score of CVE-2026-35584?

CVE-2026-35584 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19734 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-07 GitHub_M

Authentication Bypass Freescout

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8.212

EUVD ID Assigned

Apr 07, 2026 - 16:30 euvd

EUVD-2026-19734

Analysis Generated

Apr 07, 2026 - 16:30 vuln.today

CVE Published

Apr 07, 2026 - 16:07 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate opened_at timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.

AnalysisAI

Unauthenticated attackers can read arbitrary threads, enumerate thread IDs, and manipulate thread timestamps in FreeScout versions before 1.8.212 via an unvalidated IDOR vulnerability in the GET /thread/read/{conversation_id}/{thread_id} endpoint. The endpoint fails to verify both authentication and thread-conversation association, enabling complete enumeration of help desk conversations and metadata manipulation without credentials. This affects all FreeScout installations below version 1.8.212.

Technical ContextAI

FreeScout is a Laravel-based help desk application. The vulnerable endpoint implements an unauthenticated thread-read action that performs insufficient access control validation. The root cause is CWE-306 (Missing Authentication for Critical Function), combined with insecure direct object reference (IDOR) due to lack of authorization checks. The endpoint accepts conversation_id and thread_id parameters but does not verify ownership or relationship between them, nor authenticate the requesting user. The response behavior (HTTP 200 vs 404) further enables thread ID enumeration attacks. The opened_at timestamp manipulation indicates the endpoint performs write operations (state changes) without proper access restrictions.

RemediationAI

Upgrade FreeScout to version 1.8.212 or later, which includes the fix for this authentication bypass vulnerability. Organizations unable to upgrade immediately should implement network-level access controls restricting the /thread/read/ endpoint to authenticated users via a reverse proxy or WAF, and monitor access logs for enumeration patterns (multiple 404 responses to thread endpoints). See vendor advisory at https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-873c-r7v5-g98v for additional details and confirmation of patch availability.