What is the CVSS score of EUVD-2026-46095?

EUVD-2026-46095 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-46095?

Yes, a patch is available for EUVD-2026-46095. Update the affected software to the latest version immediately.

FreeScout EUVD-2026-46095

| CVE-2026-53596 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-20 GitHub_M

Denial Of Service File Upload Freescout Freescout Help Desk

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

File upload requires a user session in typical helpdesk deployments, making PR:L more accurate than PR:N; no C/I impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 20, 2026 - 23:18 EUVD

Analysis Generated

Jul 20, 2026 - 20:47 vuln.today

DescriptionCVE.org

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.

AnalysisAI

Uncontrolled resource consumption in FreeScout's file upload endpoint allows any user to flood the server with upload requests, overloading the database and causing denial of service for all platform users on versions prior to 1.8.224. The root cause is the complete absence of rate limiting on the upload route - a low-complexity, network-accessible weakness requiring no special privileges per the CVSS vector. No public exploit code or CISA KEV listing exists at time of analysis, but the trivial exploitation mechanics mean any motivated user can weaponize this without tooling.

Technical ContextAI

FreeScout is an open-source PHP helpdesk application built on the Laravel framework, used for shared inbox and ticket management. The vulnerability maps to CWE-400 (Uncontrolled Resource Consumption): without throttling on the file upload HTTP endpoint, repeated POST requests can saturate server-side resources - each upload likely triggers one or more database write operations for metadata, attachment indexing, or audit logging, creating compounding database load under flood conditions. The affected scope covers all FreeScout versions prior to 1.8.224, as indicated by the CPE cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:*, with no version range floor specified, suggesting all historical releases are affected. The fix introduces rate limiting controls on this endpoint in version 1.8.224.

RemediationAI

Upgrade FreeScout to version 1.8.224 or later, which introduces rate limiting on the file upload endpoint as the primary fix per the vendor advisory at https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-ph4f-2jhx-q76w. If immediate patching is not feasible, configure rate limiting at the reverse proxy layer (nginx's limit_req or Apache's mod_ratelimit) targeting the upload route specifically - this adds protection without application changes but requires knowledge of the exact upload endpoint path and may require tuning to avoid blocking legitimate high-volume users. A WAF rule restricting upload request frequency per source IP is a viable interim control, though distributed attacks may bypass IP-based throttling. Note that none of these compensating controls address the root cause within the application and should not substitute for patching.