CVE-2026-41902
CriticalSummary
FreeScout prior to version 1.8.217 has a vulnerability in the /user-setup/{hash} endpoint that accepts a 60-character random invite_hash to set a new user's password. The lack of expiration check allows for unauthorized account takeover long after the invite was issued.
Risk Assessment
The organization is at risk of unauthorized account takeover, which could lead to data loss and access to sensitive information, especially if the invite was sent to an admin.
Recommendation
It is recommended to upgrade to version 1.8.217 or later to mitigate this vulnerability and to review and remove old invites that may be at risk of leakage.
Other vulnerabilities in FreeScout
See all- CVE-2026-41906High
FreeScout is a free help desk and shared inbox built with the Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers, but the backend conversation_change_customer action accepts any supplied customer_email.
- CVE-2026-41905High
FreeScout prior to version 1.8.217 had a vulnerability in the Helper::sanitizeRemoteUrl() function that improperly validated URLs after HTTP redirects. An attacker could exploit this vulnerability to redirect traffic to internal HTTP services that would normally be blocked.
- CVE-2026-41904High
FreeScout prior to version 1.8.217 allows users with updateAutoReply permission to store an XSS payload in the auto-reply message. The payload is rendered unescaped in the auto-reply email sent to customers.
- CVE-2026-53595Critical
In FreeScout before version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` allows an attacker to take over a user account without authentication. The vulnerability is due to trailing space equality in MySQL/MariaDB VARCHAR and improper decryption of the `invite_sent_at` parameter.
- CVE-2026-53596Medium
FreeScout, a free help desk built with Laravel, does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.
- CVE-2026-53594Medium
FreeScout prior to version 1.8.224 has a vulnerability in the App Logs feature that allows an authenticated attacker to download arbitrary server-local files readable by the PHP process via manipulation of the dl parameter.
- CVE-2026-53593High
FreeScout before version 1.8.224 has an incomplete denylist of dangerous file extensions, missing the .pht extension. An authenticated agent can upload a .pht web shell, leading to remote code execution on the web server.
- CVE-2026-53592Medium
A Prototype Pollution vulnerability in the getQueryParam function in /public/js/main.js in FreeScout. The fix in version 1.8.139 is incomplete, allowing attacks via nested URL keys. Fixed in version 1.8.223.
- CVE-2026-53591High
Vulnerability in FreeScout before version 1.8.223. An unauthenticated attacker can inject a message into any existing support conversation by sending an email with a crafted In-Reply-To header. The message appears as a customer reply, and the conversation is automatically reopened.
- CVE-2026-48812High
Vulnerability in FreeScout (versions prior to 1.8.221) in the attachment download mechanism. An unauthenticated attacker can download any attachment created by an older version because token authentication is skipped for attachments with legacy token type.
Original NVD description (English source)
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-character random invite_hash to set a new user's password. The endpoint performs no expiration check — the hash remains valid indefinitely until consumed. Combined with realistic hash-leakage scenarios (forwarded invite emails, HTTP referrer to external CDNs on the setup page, server-side log exposure, abandoned invite emails in shared inboxes), this enables unauthenticated permanent account takeover months or years after invite issuance. If the leaked invite was sent to an admin, the takeover yields admin access. This issue has been patched in version 1.8.217.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS