CVE-2026-45294: FreeScout: User Account Enumeration via Password Reset Response Differentiation

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-29 · updated 2026-07-22
Weakness: CWE-203

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.

Affected products

freescout-help-desk freescout: before 1.8.219

References

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jvmv-2qcp-7855
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jvmv-2qcp-7855

Get alerted when CVE-2026-45294 or the next vulnerability affects your stack