CVE-2026-35584
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-306
Ausencia de autenticación para una función crítica
Fecha de publicación:
07/04/2026
Última modificación:
07/04/2026
Descripción
*** Pendiente de traducción *** FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to mark any thread as read by passing arbitrary IDs, enumerate valid thread IDs via HTTP response codes (200 vs 404), and manipulate opened_at timestamps across conversations (IDOR). This vulnerability is fixed in 1.8.212.
Impacto
Puntuación base 4.0
6.90
Gravedad 4.0
MEDIA