FreeScout CVE-2026-45294

No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation against default configurations of FreeScout prior to 1.8.219. Any FreeScout instance with a network-accessible password reset endpoint is exploitable without authentication, elevated privileges, or user interaction. The primary limiting factor is network reachability: FreeScout instances deployed exclusively on internal networks with no external exposure face significantly reduced risk, as exploitation requires the ability to send HTTP requests to the password reset endpoint. The impact is further bounded by the nature of the disclosure - only account existence (a boolean signal) is leaked per request, with no access to credentials, session data, or account content.

The CVSS score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the bounded impact - only account existence is disclosed, not credentials, session tokens, or sensitive data. The attack requires no authentication and no special configuration, making it automatable against any internet-facing FreeScout deployment. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. The vulnerability does not appear in the CISA KEV catalog, and no public exploit code has been identified, indicating no confirmed active exploitation at time of analysis. The realistic risk lies in downstream attack enablement: enumerated helpdesk agent email addresses lower the barrier to targeted phishing, credential stuffing against corporate email systems, or social engineering of support staff. For organizations where agent email addresses are not publicly known (e.g., internal-only helpdesks), this represents a meaningful reconnaissance capability. For organizations with publicly visible agent emails, the incremental risk is lower.

An unauthenticated attacker submits automated password reset requests to the FreeScout instance, cycling through a wordlist of corporate email addresses or common naming patterns. By comparing the visually distinct HTTP responses, the attacker identifies which addresses correspond to active helpdesk agent accounts and builds a validated target list. No exploit code is required beyond a simple scripted HTTP client; the compiled email list then serves as the basis for spear phishing campaigns or credential stuffing against external services.