Freescout EUVD-2026-24049

Exploitation requires only network access to the FreeScout web interface-no authentication, user interaction, or special configuration needed. Default FreeScout installations with standard attachment handling enabled are vulnerable. The attack succeeds against any instance where attachments are stored (typical configuration for help desk usage). Limiting factors: attacker must know or guess the APP_KEY value (a Laravel application secret typically stored in .env file) to generate valid tokens, though with sequential IDs and predictable sizes, brute-forcing becomes feasible if APP_KEY follows common patterns or default values. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default configurations of FreeScout help desk systems. Installations with attachments disabled or network access restricted to authenticated internal users only are not exploitable remotely, but these represent non-standard defensive configurations rather than default protection.

This vulnerability presents HIGH real-world risk for organizations using affected FreeScout versions. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation with low complexity-attackers need only network access to the FreeScout instance with no user interaction. The E:P modifier indicates proof-of-concept code exists, lowering the exploitation barrier. High confidentiality impact (VC:H) reflects exposure of potentially sensitive customer correspondence, support tickets, contracts, or regulated data exchanged via email attachments. High integrity impact (VI:H) suggests attackers could potentially manipulate attachment metadata or access control after compromise. EPSS score not provided but the combination of public exploit, no authentication requirement, and sensitive data exposure suggests moderate-to-high exploitation probability in internet-facing deployments. SSVC framework indicators: exploitation is POC-confirmed, attack is fully automatable via sequential enumeration scripts, and technical impact is total for attachment confidentiality. Critical missing data: confirmation of whether the vulnerability affects only self-hosted instances or also managed/SaaS deployments. Priority assessment: IMMEDIATE for internet-facing FreeScout instances handling sensitive customer data, HIGH for internal deployments with confidential support communications.

An external attacker identifies a FreeScout instance at support.victim.com by recognizing the distinctive UI or HTTP headers. Without creating an account, they write a Python script that iterates attachment_id from 1 to 10000 and size from 1KB to 50MB in common increments, hashing each combination as md5(guessed_APP_KEY + id + size). For each generated token, the script requests /download?attachment_id=X&token=Y. When a token matches, the server returns the attachment file. Within hours, the attacker downloads thousands of customer support attachments including contracts, invoices, password reset emails, and personal identification documents, enabling identity theft, corporate espionage, or ransomware extortion based on exposed sensitive data.