FreeScout - Authentication Bypass (CVE-2026-53595)
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/{hash}/{invite_sent_at} (OpenController@userSetupSave) selects the target account solely by its invite_hash column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets invite_hash to the empty string. On MySQL and MariaDB, VARCHAR equality ignores trailing spaces, so a single URL-encoded space (%20) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts invite_sent_at with the target's password hash, but Helper::decrypt returns its raw input unchanged when decryption fails. A plaintext numeric value such as 9999999999 therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.
psychologyCrowdSec Analysis
CVE-2026-53595 is a critical authentication bypass vulnerability in FreeScout versions prior to 1.8.224, allowing unauthenticated remote attackers to overwrite an activated user’s email and password and log in as that account. Exploitation can grant access to sensitive help desk data, enable account takeover and administrative compromise, and potentially disrupt support operations.
CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.
Data from the CrowdSec community indicates that exploitation of CVE-2026-53595 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec data also reveals a clear uptick in attacks involving CVE-2026-53595 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Attackers target the /user-setup/ endpoint with a crafted invite-hash path, such as /user-setup/%20/9999999999, to bypass authorization and access the user setup wizard without authentication. Successful exploitation may allow them to reset credentials for an activated user and gain account or administrative access.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-07-20 |
| CrowdSec First Seen | 2026-09-15 |
| Rule Released | 2026-09-17 |
Related Weaknesses
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.