CVE-2026-53595

Received Received - Intake

Authentication Bypass in FreeScout Help Desk

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-53595

Affected Vendors & Products

Vendor	Product	Version / Range
freescout	freescout	1.8.224

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CWE-640	The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability in FreeScout allows an unauthenticated attacker to take over the lowest-ID activated account by exploiting improper handling of invite hashes and decryption failures. The endpoint POST /user-setup/{hash}/{invite_sent_at} overwrites an account's email and password without requiring authentication, using a URL-encoded space to match an empty invite_hash value. The expiry check fails silently, allowing the attacker to bypass time restrictions and gain full access to the account.

Detection Guidance

Check FreeScout version for 1.8.224 or later. Monitor logs for POST requests to /user-setup/{hash}/{invite_sent_at} with URL-encoded spaces in the hash. Verify no unauthorized account email or password changes occurred.

Impact Analysis

If you use FreeScout before version 1.8.224, an attacker could gain control of your support agent or administrator account. This could lead to unauthorized access to sensitive customer data, manipulation of support tickets, or complete compromise of your help desk system. The attacker needs no prior access or credentials to exploit this.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to personal and protected health information. GDPR requires strict access controls and breach notification, while HIPAA mandates safeguards for protected health data. A successful exploit could result in unauthorized data exposure, triggering mandatory breach reporting and potential fines.

Mitigation Strategies

Immediately upgrade FreeScout to version 1.8.224 or later to address the vulnerability. Review and restrict access to the /user-setup endpoint if possible. Monitor for unauthorized account changes or logins.

Hi! I’m here to help you understand CVE-2026-53595. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70