ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27637

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.

Published Feb 25, 2026 · updated Jun 17, 2026 · freescout freescout

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's middleware uses a predictable authentication token computed as . This token is static (never expires/rotates), and if an attacker obtains the — a well-documented and common exposure vector in Laravel applications — they can compute a valid token for any user, including the administrator, achieving full account takeover without any password. This vulnerability can be exploited on its own or in combination with CVE-2026-27636. Version 1.8.206 fixes both vulnerabilities.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2026 · NIST NVD

    Detected

    FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's middleware uses a predictable authentication token computed as . This token is static (never expires/rotates), and if an attacker obtains the — a well-documented and common exposure vector in Laravel applications — they can compute a valid token for any user, including the admin

  2. Jun 17, 2026 · NIST NVD

    Updated

    FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's middleware uses a predictable authentication token computed as . This token is static (never expires/rotates), and if an attacker obtains the — a well-documented and common exposure vector in Laravel applications — they can compute a valid token for any user, including the admin

Affected

  • cpe freescout/freescoutversion unspecified

Sources

  • NIST NVDVulnerability recordCVE-2026-27637

    FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's middleware uses a predictable authentication token computed as . This token is static (never expires/rotates),

    nvd.nist.gov

References