Authentication Bypass Vulnerability in FreeScout Help Desk by Freescout
CVE-2026-35584
Key Information:
- Vendor
Freescout-help-desk
- Status
- Vendor
- CVE Published:
- 7 April 2026
Badges
What is CVE-2026-35584?
FreeScout, a help desk and shared inbox tool built on the Laravel framework, has an authentication bypass vulnerability that allows unauthenticated users to manipulate conversation threads. Versions prior to 1.8.212 are affected. The vulnerability arises from the GET endpoint /thread/read/{conversation_id}/{thread_id} not validating ownership of thread IDs. Attackers can exploit this flaw to mark threads as read, test the existence of thread IDs through different HTTP response codes, and alter timestamps, which poses significant privacy risks and potential data leakage.
Affected Version(s)
freescout < 1.8.212
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.