CVE-2026-53596 | FreeScout is a free help desk and shared inbox built with PH… | CVSS 5.3 MEDIUM

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.

Metadata

CVE ID: CVE-2026-53596
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-09 19:39 UTC
Published: 2026-07-20 20:17 UTC
Last updated: 2026-07-21 16:27 UTC
Primary CWE: CWE-400
CWE-400: Uncontrolled Resource Consumption
Vendor / Product: freescout-help-desk / freescout
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
freescout-help-desk	freescout	—	< 1.8.224

Weakness (CWE)

CWE	Source	Description
CWE-400	cna	CWE-400: Uncontrolled Resource Consumption
CWE-770	cna	CWE-770: Allocation of Resources Without Limits or Throttling

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References (1)

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-ph4f-2jhx-q76w https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-ph4f-2jhx-q76w