CVE-2026-35584

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate opened_at timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.

• CWE-306
• CWE-639

• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-873c-r7v5-g98vExploit, Vendor Advisory
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-873c-r7v5-g98vExploit, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35579CoreDNS is a DNS server written in Go. In versions prior to …9.8
• CVE-2026-3558Philips Hue Bridge HomeKit Accessory Protocol Transient Pair…8.1
• CVE-2026-35580Emissary is a P2P based data-driven workflow engine. Prior t…9.1
• CVE-2026-35581Emissary is a P2P based data-driven workflow engine. Prior t…7.2
• CVE-2026-35582Emissary is a P2P based data-driven workflow engine. In vers…8.8
• CVE-2026-35583Emissary is a P2P based data-driven workflow engine. Prior t…5.3
• CVE-2026-35585File Browser is a file managing interface for uploading, del…7.2
• CVE-2026-35586pyLoad is a free and open-source download manager written in…6.8
• CVE-2026-35587Glances is an open-source system cross-platform monitoring t…8.8
• CVE-2026-35588Glances is an open-source system cross-platform monitoring t…6.3
• CVE-2026-35589nanobot is a personal AI assistant. Versions prior to 0.1.5 …9.3
• CVE-2026-3559Philips Hue Bridge HomeKit Accessory Protocol Static Nonce A…8.1