CVE-2026-45294: FreeScout User Enumeration in Password Reset Endpoint

Technical summary

The vulnerability stems from an information disclosure flaw in FreeScout's password reset endpoint (CWE-203: Observable Discrepancy, CWE-204: Observable Timing Discrepancy). When an unauthenticated user submits an email address, the endpoint returns visually distinct responses based on whether that address corresponds to an existing agent account. This allows systematic enumeration of valid helpdesk user identities without authentication. The issue is patched in version 1.8.219 by normalizing response behavior regardless of account existence.

Business impact

User enumeration weakens the security perimeter of a help desk deployment by allowing attackers to build a roster of valid agent email addresses without triggering alerts. This reconnaissance lowers the barrier to subsequent targeted attacks—such as credential stuffing, phishing, or social engineering against known staff members. For organizations running FreeScout as their primary support channel, this indirect exposure can compromise agent account security and ultimately affect customer data confidentiality.

Affected systems

FreeScout versions prior to 1.8.219 are affected. The vulnerability is present in the password reset endpoint and does not require specific configuration or plugins to be enabled. Any FreeScout installation accessible via HTTP(S) is potentially exploitable.

Exploitability

Exploitability is high from a practical standpoint: no authentication is required, the attack is trivial to automate, and the vulnerable endpoint is a standard feature of every FreeScout deployment. The CVSS score of 5.3 (MEDIUM) reflects limited direct impact—no data is stolen, systems are not compromised—but the reconnaissance value to attackers is substantial. The attack requires only network access and incurs minimal operational noise.

Remediation

Upgrade FreeScout to version 1.8.219 or later immediately. For organizations unable to patch promptly, consider network-level mitigations: restrict access to the password reset endpoint via WAF rules or IP allowlisting, monitor for high-velocity requests to that endpoint, and consider temporarily disabling password reset if the help desk uses single sign-on or alternative credential recovery.

Patch guidance

Apply version 1.8.219 or any subsequent release. Verify the patch is in place by attempting to confirm the version in your FreeScout admin panel or examining the release notes. If you maintain a custom deployment, ensure all files in the authentication module are updated and any caching layers (Redis, memcached) are cleared post-deployment.

Detection guidance

Monitor password reset endpoint activity for anomalous request patterns: high volume of requests from a single IP, requests cycling through a large list of email addresses, or requests with malformed payloads designed to extract timing differences. Log and alert on response code or timing variance. Implement rate limiting on the password reset endpoint (e.g., 5 requests per IP per 10 minutes) to naturally constrain enumeration attacks.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability should be prioritized for remediation within 2–4 weeks because it enables reconnaissance that often precedes more damaging attacks against help desk staff. User enumeration is a low-noise technique that leaves minimal forensic traces and is frequently paired with phishing or credential attacks. Early patching blocks a reconnaissance vector that attackers actively seek in support desk systems.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects a low confidentiality impact (unauthenticated users learn email addresses) with no integrity or availability impact. The attack vector is network-based and requires no privileges or user interaction, making it trivially exploitable. The score appropriately penalizes the information disclosure but does not amplify the reconnaissance value or downstream attack chain risk, which are business and threat-model factors that security teams should layer on top of the base score.

Frequently asked questions