CVE-2026-45294CWE-203CWE-204

FreeScout: User Account Enumeration via Password Reset Response Differentiation

Medium · published May 29, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing unauthenticated attackers to enumerate valid helpdesk agent email addresses. This vulnerability is fixed in 1.8.219.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.7th percentile
Weaknesses
CWE-203 · Observable Discrepancy; CWE-204 · Observable Response Discrepancy
Published
2026-05-29T19:52Z
EPSS history
Timeline
  • 29 MAY 19:52Z
    FreeScout: User Account Enumeration via Password Reset Response Differentiation
    cvelistv5