The vulnerability is an unauthenticated IDOR in the GET /thread/read/{conversation_id}/{thread_id} endpoint of FreeScout. The endpoint does not require a logged‑in user and does not verify that the supplied thread_id belongs to the given conversation_id. Consequently, an attacker can change the read status of arbitrary threads, infer the existence of threads by checking HTTP 200 versus 404 responses, and adjust opened_at timestamps across conversations. These actions expose sensitive conversation data and allow manipulation of the help‑desk timeline without authorization.

FreeScout help‑desk software, version 1.8.212 and earlier. The vendor is freescout-help-desk. The vulnerability applies to all installations that have not been updated to the patched version.

The CVSS score is 6.9, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, implying that no widespread exploitation has been reported. However, because the endpoint is publicly accessible and does not enforce authentication, an attacker can invoke it from anywhere on the internet or from within a compromised network. The primary attack vector is HTTP request to the vulnerable URL, and the impact is limited to the affected site’s data and user experience.