CVE-2026-53595
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In FreeScout before version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` allows an attacker to take over a user account without authentication. The vulnerability is due to trailing space equality in MySQL/MariaDB VARCHAR and improper decryption of the `invite_sent_at` parameter.
Risk Assessment
An anonymous attacker can change the email and password of the oldest activated account (agent or administrator) and then log in as that user, gaining full access to the help desk system.
Recommendation
Immediately update FreeScout to version 1.8.224 or later. If an update is not possible, temporarily block access to the `/user-setup/{hash}/{invite_sent_at}` endpoint from untrusted IP addresses.
Other vulnerabilities in FreeScout
See all- CVE-2026-41906High
FreeScout is a free help desk and shared inbox built with the Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers, but the backend conversation_change_customer action accepts any supplied customer_email.
- CVE-2026-41905High
FreeScout prior to version 1.8.217 had a vulnerability in the Helper::sanitizeRemoteUrl() function that improperly validated URLs after HTTP redirects. An attacker could exploit this vulnerability to redirect traffic to internal HTTP services that would normally be blocked.
- CVE-2026-41904High
FreeScout prior to version 1.8.217 allows users with updateAutoReply permission to store an XSS payload in the auto-reply message. The payload is rendered unescaped in the auto-reply email sent to customers.
- CVE-2026-41902Critical
FreeScout prior to version 1.8.217 has a vulnerability in the /user-setup/{hash} endpoint that accepts a 60-character random invite_hash to set a new user's password. The lack of expiration check allows for unauthorized account takeover long after the invite was issued.
- CVE-2026-53596Medium
FreeScout, a free help desk built with Laravel, does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potential denial of service for all users. Version 1.8.224 contains a fix.
- CVE-2026-53594Medium
FreeScout prior to version 1.8.224 has a vulnerability in the App Logs feature that allows an authenticated attacker to download arbitrary server-local files readable by the PHP process via manipulation of the dl parameter.
- CVE-2026-53593High
FreeScout before version 1.8.224 has an incomplete denylist of dangerous file extensions, missing the .pht extension. An authenticated agent can upload a .pht web shell, leading to remote code execution on the web server.
- CVE-2026-53592Medium
A Prototype Pollution vulnerability in the getQueryParam function in /public/js/main.js in FreeScout. The fix in version 1.8.139 is incomplete, allowing attacks via nested URL keys. Fixed in version 1.8.223.
- CVE-2026-53591High
Vulnerability in FreeScout before version 1.8.223. An unauthenticated attacker can inject a message into any existing support conversation by sending an email with a crafted In-Reply-To header. The message appears as a customer reply, and the conversation is automatically reopened.
- CVE-2026-48812High
Vulnerability in FreeScout (versions prior to 1.8.221) in the attachment download mechanism. An unauthenticated attacker can download any attachment created by an older version because token authentication is skipped for attachments with legacy token type.
Original NVD description (English source)
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.