FreeScout, a PHP Laravel-based help desk application, had a vulnerability (CVE-2026-45294) where its password reset endpoint returned different visual responses based on the existence of the submitted email address in the system. This observable discrepancy enables unauthenticated attackers to enumerate valid user email addresses, potentially aiding further targeted attacks. The vulnerability is classified under CWE-203 (Observable Discrepancy) and CWE-204 (Information Exposure Through Discrepancy). It affects versions prior to 1.8.219 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No official patch or vendor advisory is provided in the data, but the issue is noted as fixed in version 1.8.219.

The vulnerability allows unauthenticated attackers to confirm the existence of valid helpdesk agent email addresses by observing differences in password reset responses. This information disclosure can facilitate targeted phishing or social engineering attacks. There is no indication of direct compromise of confidentiality, integrity, or availability beyond this information exposure.

Upgrade FreeScout to version 1.8.219 or later, where this vulnerability is fixed. Since no official vendor advisory or patch link is provided, verify the upgrade from the official FreeScout release notes or repository to ensure the fix is applied. Patch status is not yet confirmed via vendor advisory; check official FreeScout sources for current remediation guidance.