What is the CVSS score of CVE-2026-45295?

CVE-2026-45295 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-45295?

Yes, a patch is available for CVE-2026-45295. Update the affected software to the latest version immediately.

FreeScout CVE-2026-45295

EUVD-2026-46043 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-20 GitHub_M

Authentication Bypass Freescout Freescout Help Desk

6.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible unauthenticated endpoint; C:L for ID enumeration, I:L for timestamp forgery, A:N as no availability impact exists.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 20, 2026 - 19:03 EUVD

Analysis Generated

Jul 20, 2026 - 18:27 vuln.today

DescriptionCVE.org

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint GET /thread/read/{conversation_id}/{thread_id} allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (opened_at timestamp) without any authentication. Version 1.8.219 patches the issue.

AnalysisAI

Unauthenticated access to FreeScout's email open-tracking endpoint (GET /thread/read/{conversation_id}/{thread_id}) allows remote attackers to enumerate valid conversation and thread IDs and manipulate the opened_at timestamp on arbitrary threads. All FreeScout deployments prior to version 1.8.219 are affected. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

FreeScout is an open-source help desk and shared inbox application built on PHP's Laravel framework. The vulnerable endpoint is part of the email open-tracking subsystem - a pixel-tracking mechanism that records when a recipient opens a support email. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the application accepts caller-supplied conversation and thread ID values and acts on them without verifying that the caller has any authorization to access or modify those resources. Because integer IDs are typically sequential and predictable, an unauthenticated attacker can trivially iterate the ID space. The affected CPE is cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:* covering all versions prior to 1.8.219.

RemediationAI

Upgrade FreeScout to version 1.8.219 or later, which is confirmed by the vendor advisory at https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-qjr9-6v9q-3r72 to patch this issue. If an immediate upgrade is operationally infeasible, the most targeted compensating control is to block external HTTP requests to the /thread/read/ path at the reverse proxy or web server layer (e.g., via an nginx location deny rule or Apache RewriteRule); the trade-off is that legitimate email open-tracking for externally-delivered emails will stop functioning until the upgrade is applied. A broader mitigation is to place the FreeScout instance behind a VPN or strict IP allowlist so the endpoint is not reachable from arbitrary internet addresses, accepting the trade-off of restricted remote access for support staff and customers.