FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL (CVE-2026-53595)

What is affected, what to do

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it.

The vulnerability is being actively exploited; treat it as a priority. Update Freescout to version 1.8.224.

Affected

• Freescout lt *..1.8.224

Fixed in

• Freescout 1.8.224

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.

Source: cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Freescout-help-desk Freescout

Weakness classes (CWE)

• CWE-178Improper Handling of Case Sensitivity

  Base

  The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

  Entry at MITRE CWE-178

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

• CWE-640Weak Password Recovery Mechanism for Forgotten Password

  Base

  The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

  Entry at MITRE CWE-640

References & sources

• github.comfreescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72…x_refsource_CONFIRM

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 21.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: proof of concept, automatable: yes

   New references:

   • https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g
   SSVC assessment	added	—	{"id":"CVE-2026-53595","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-21T13:20:35.944303Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.