FreeScout, an open‑source help‑desk built on Laravel, exposes an open tracking endpoint that accepts GET requests to /thread/read/{conversation_id}/{thread_id}. Prior to version 1.8.219, unauthenticated visitors can enumerate valid conversation and thread identifiers and alter the opened_at timestamp of any thread. This flaw lets attackers hide ticket read status and gain insight into the underlying data model, potentially facilitating further reconnaissance.

The affected product is FreeScout, a free help‑desk and shared‑inbox solution built on Laravel. All installations running a version older than 1.8.219 are vulnerable, regardless of deployment size or configuration.

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1 % signifies a low probability of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Attacks are delivered through a simple unauthenticated HTTP GET request to the open tracking endpoint, making the attack vector network‑based and requiring no special privileges. Because the endpoint accepts the conversation and thread identifiers directly as URL components, enumeration of valid IDs is trivial, giving an attacker insight into the data model and a foothold for further reconnaissance.