CVE-2026-35584 Missing authorization in freescout
Unauthenticated attackers can manipulate thread read status and enumerate valid thread IDs in FreeScout due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35584?
CVE-2026-35584 is a medium-severity missing authorization vulnerability in freescout-help-desk freescout, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate opened_at timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.
Which versions are affected by CVE-2026-35584?
It affects 1 product.
Products include Freescout Freescout.
How do I fix CVE-2026-35584?
No fix has been published for CVE-2026-35584 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-35584 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35584 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in freescout-help-desk freescout
- CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
- CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover
- CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
- CVE-2024-29185 FreeScout OS Command Injection vulnerability
- CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
Sources
Also known as GHSA-873c-r7v5-g98v.