Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.
Published: 2026-07-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

FreeScout is a Laravel‑based help desk that allows users to upload arbitrary files. Prior to version 1.8.224 the upload endpoint lacks any rate limiting, enabling an attacker to flood the server with requests. This overloads the database layer, exhausting resources and leading to denial of service for all users. The flaw is a classic resource exhaustion vulnerability and is mapped to CWE‑400 and CWE‑770.

Affected Systems

The vulnerability affects the FreeScout help‑desk application developed by freescout‑help‑desk. Versions prior to 1.8.224 are impacted; the issue is fixed in version 1.8.224.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. The EPSS score of < 1% indicates a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers require no authentication. They can issue a large volume of upload requests to trigger database overload, causing service disruption.

Generated by OpenCVE AI on July 30, 2026 at 18:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FreeScout to version 1.8.224 or later.
  • If an immediate upgrade is not possible, implement server‑side or network‑level rate limiting on the file‑upload endpoint.
  • Block or throttle repeated upload requests from a single IP or user account to prevent database overload.

Generated by OpenCVE AI on July 30, 2026 at 18:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Freescout Helpdesk
Freescout Helpdesk freescout
Vendors & Products Freescout Helpdesk
Freescout Helpdesk freescout

Mon, 20 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.
Title FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)
Weaknesses CWE-400
CWE-770
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Freescout Helpdesk Freescout
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-21T16:27:52.079Z

Reserved: 2026-06-09T19:39:52.403Z

Link: CVE-2026-53596

cve-icon Vulnrichment

Updated: 2026-07-21T16:24:02.987Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T18:45:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling