FreeScout - Authentication Bypass (CVE-2026-53595)
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/{hash}/{invite_sent_at} (OpenController@userSetupSave) selects the target account solely by its invite_hash column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets invite_hash to the empty string. On MySQL and MariaDB, VARCHAR equality ignores trailing spaces, so a single URL-encoded space (%20) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts invite_sent_at with the target's password hash, but Helper::decrypt returns its raw input unchanged when decryption fails. A plaintext numeric value such as 9999999999 therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.
psychologyCrowdSec Analysis
CVE-2026-53595 is a critical authentication bypass vulnerability in FreeScout versions prior to 1.8.224, allowing unauthenticated remote attackers to overwrite an activated user’s email and password and log in as that account. Exploitation can grant access to sensitive help desk data, enable account takeover and administrative compromise, and potentially disrupt support operations.
CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.
CrowdSec network observations suggest that most exploitation of CVE-2026-53595 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2026-53595 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2026-53595 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.
Attackers target the /user-setup/ endpoint with a crafted invite-hash path, such as /user-setup/%20/9999999999, to bypass authorization and access the user setup wizard without authentication. Successful exploitation may allow them to reset credentials for an activated user and gain account or administrative access.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-07-20 |
| CrowdSec First Seen | 2026-09-15 |
| Rule Released | 2026-09-17 |
Related Weaknesses
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.