Vulnerability · Published May 29, 2026 · Assigned by GitHub_M
CVE-2026-45294FreeScout: User Account Enumeration via Password Reset Response Differentiation
Medium 5.3
In plain English
A medium-severity security flaw in freescout from freescout-help-desk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| freescout-help-desk | freescout | < 1.8.219 |
Weakness: CWE-203, CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N