FreeScout CVE-2026-45295

The FreeScout web application must be reachable over the network from the attacker's position - typically via a public-facing URL but also exploitable from an internal network segment. The CVSS vector (PR:N, UI:N) confirms no authentication, existing account, or user interaction is required. The email open-tracking feature is part of FreeScout's default installation and does not require non-default configuration to be present. Exploitation is practically limited by the need to iterate ID values (though sequential integer IDs offer minimal protection), and the impact ceiling is ID enumeration plus timestamp manipulation - no code execution, file access, or credential exposure is possible through this vector alone.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N correctly characterizes a low-complexity, fully unauthenticated network attack with limited but concrete impact. The attack requires zero privileges and no user interaction, making it trivially exploitable from any network position that can reach the FreeScout instance. The practical impact is twofold: enumeration of valid conversation and thread IDs (C:L - confirms existence of support tickets, customer communications) and forgery of email open-tracking state (I:L - falsifies whether emails were read, misleading support staff on customer engagement). EPSS data was not provided in the input, and this CVE does not appear in CISA KEV, so no quantified exploitation probability or confirmed in-the-wild activity is available. There is no code execution, credential theft, or availability impact, so while exploitation is trivially easy, the blast radius is bounded by the sensitivity of the help desk data and the reliance staff place on open-tracking metrics. This is a real but moderate risk - not a critical emergency but a straightforward fix with no workaround complexity.

An attacker with HTTP access to a public FreeScout instance sends sequential GET requests to /thread/read/1/1, /thread/read/1/2, and so on, observing response differences to confirm which conversation and thread ID pairs are valid - effectively mapping the active support ticket space without any account. Simultaneously, each request causes the server to record a false opened_at timestamp on the targeted thread, causing support agents to believe customers have read emails they may never have opened. No public POC has been identified, but the attack requires only a basic HTTP client and iterative scripting.