What is the CVSS score of CVE-2026-45294?

CVE-2026-45294 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45294?

Yes, a patch is available for CVE-2026-45294. Update the affected software to the latest version immediately.

FreeScout CVE-2026-45294

EUVD-2026-33441 MEDIUM

Observable Discrepancy (CWE-203)

2026-05-29 GitHub_M

Information Disclosure Freescout

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 29, 2026 - 21:02 EUVD

Analysis Generated

May 29, 2026 - 20:35 vuln.today

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.

AnalysisAI

FreeScout help desk software prior to version 1.8.219 leaks account existence through its password reset endpoint, enabling unauthenticated remote attackers to enumerate valid helpdesk agent email addresses at scale. The endpoint returns visually distinct responses depending on whether a submitted email is registered, violating CWE-203 (Observable Discrepancy) and creating a reliable reconnaissance channel. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the zero-authentication, low-complexity attack surface makes automated enumeration trivially achievable against any internet-exposed FreeScout instance running a pre-1.8.219 version.

Technical ContextAI

FreeScout is an open-source PHP application built on the Laravel framework, designed as a self-hosted help desk and shared inbox solution. The vulnerable component is the password reset workflow - a standard Laravel authentication feature - which fails to implement a uniform response regardless of whether the submitted email address maps to a real user account. CWE-203 (Observable Discrepancy) identifies the root cause class: the application's differing responses constitute an information side-channel that leaks internal account state to unauthenticated requesters. The CPE string cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:* indicates the wildcard version field, meaning all versions of the freescout-help-desk/freescout package are affected until the fix was introduced in 1.8.219. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N precisely captures the scope: network-reachable, no complexity barrier, no credentials required, no user interaction, with limited confidentiality impact restricted to account existence disclosure.

RemediationAI

Vendor-released patch: FreeScout 1.8.219, confirmed by the vendor's GitHub Security Advisory GHSA-jvmv-2qcp-7855 (https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jvmv-2qcp-7855). Upgrade to version 1.8.219 or later as the primary and definitive fix. If immediate patching is not feasible, implement rate limiting on the password reset endpoint (e.g., via nginx or a WAF rule) to throttle enumeration throughput - note this does not eliminate the information discrepancy but significantly raises the cost of large-scale enumeration and may cause latency for legitimate users who trigger limits. Additionally, restricting network access to the FreeScout instance to trusted IP ranges eliminates external enumeration entirely but is only viable for internal-facing deployments. Neither compensating control is a substitute for upgrading to 1.8.219.