CVE-2026-53595
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In FreeScout before version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` allows an attacker to take over a user account without authentication. The vulnerability is due to trailing space equality in MySQL/MariaDB VARCHAR and improper decryption of the `invite_sent_at` parameter.
Risk Assessment
An anonymous attacker can change the email and password of the oldest activated account (agent or administrator) and then log in as that user, gaining full access to the help desk system.
Recommendation
Immediately update FreeScout to version 1.8.224 or later. If an update is not possible, temporarily block access to the `/user-setup/{hash}/{invite_sent_at}` endpoint from untrusted IP addresses.
Original NVD description (English source)
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.