CVE-2026-53595 in FreeScout
Summary
by MITRE • 07/21/2026
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in FreeScout affects versions prior to 1.8.224 and stems from a critical authentication bypass flaw in the user setup endpoint. The vulnerable endpoint POST /user-setup/{hash}/{invite_sent_at} operates without any authentication requirements, allowing anonymous attackers to directly manipulate account credentials through a simple HTTP POST request. This flaw exists because the system relies solely on the invite_hash column for account selection, creating an exploitable path where attackers can gain unauthorized access to existing user accounts. The vulnerability demonstrates poor input validation and insufficient access controls that violate fundamental security principles.
The technical implementation of this vulnerability exploits specific behaviors in MySQL and MariaDB database systems where VARCHAR equality operations ignore trailing spaces. When an attacker crafts a URL-encoded space character (%20) as part of the invite_hash parameter, it matches against the empty string stored in the database due to how these database systems handle string comparisons. This database behavior creates an unexpected attack vector where a single space character can effectively bypass account selection logic and target the lowest-id activated user record in the system. The vulnerability extends beyond simple account takeover as it leverages multiple interconnected flaws in the authentication flow.
The operational impact of this vulnerability is severe, as it allows attackers to completely compromise any existing FreeScout installation by targeting the lowest-id activated account. This could result in unauthorized access to support agent accounts or administrative privileges if such accounts were created through invitations. The attacker can then modify email and password fields, effectively taking control of legitimate user accounts and potentially gaining access to sensitive customer data, support tickets, and system configurations. The attack requires no prior knowledge of valid credentials or session information, making it particularly dangerous for organizations relying on FreeScout for their help desk operations.
The vulnerability chain involves multiple security weaknesses that compound the risk. First, the lack of authentication checks on the user setup endpoint creates an unauthenticated access point. Second, the flawed database comparison behavior allows attackers to manipulate hash matching through simple whitespace characters. Third, the Helper::decrypt function fails to properly validate decryption results, returning raw input when decryption fails instead of throwing appropriate exceptions or returning null values. This allows plaintext numeric values like 9999999999 to pass time-to-live validation checks without any legitimate secret key, effectively bypassing all temporal security controls. The combination of these flaws creates a complete authentication bypass scenario that violates the principle of least privilege and proper access control enforcement.
The fix implemented in version 1.8.224 addresses this vulnerability by correcting the authentication flow to properly validate user sessions and implement additional checks on the invite_hash parameter. Security practitioners should note this vulnerability aligns with CWE-287 (Improper Authentication) and CWE-345 (Insufficient Verification of Data Authenticity) categories, while also demonstrating characteristics of ATT&CK technique T1078 (Valid Accounts) through unauthorized account access. Organizations using FreeScout should immediately upgrade to version 1.8.224 or later and review their existing installations for potential compromise. The vulnerability serves as an example of how seemingly minor implementation details in database interactions can create significant security risks when combined with improper input validation and authentication flow design.