The vulnerability exists in FreeScout's password reset endpoint. When an email address is submitted, the system returns distinct responses depending on whether the address is associated with an existing user account. This allows an unauthenticated attacker to identify valid user accounts. The primary impact is that attackers can enumerate legitimate user addresses, paving the way for targeted phishing or credential‑guessing campaigns.

The flaw affects deployments of the freescout-help-desk:freescout product running any version prior to 1.8.219. Versions 1.8.219 and later include the patch that ensures the password reset response is indistinguishable for valid and invalid email addresses.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and unauthenticated, using the publicly accessible password reset endpoint. An attacker who submits arbitrary email addresses can construct a list of valid user accounts, thereby increasing the attack surface for subsequent phishing or credential‑based attacks.