# CVE-2026-53595: FreeScout - Authentication Bypass

> Live exploitation tracking for CVE-2026-53595 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-53595

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.4
- **Public exploit available:** Yes
- **Affected products:** FreeScout Help Desk FreeScout
- **Weaknesses:** CWE-178 (Improper Handling of Case Sensitivity); CWE-640 (Weak Password Recovery Mechanism for Forgotten Password)
- **Tags:** php, web_application

## Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.

## CrowdSec analysis

[CVE-2026-53595](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-53595) is a critical authentication bypass vulnerability in FreeScout versions prior to 1.8.224, allowing unauthenticated remote attackers to overwrite an activated user’s email and password and log in as that account. Exploitation can grant access to sensitive help desk data, enable account takeover and administrative compromise, and potentially disrupt support operations.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-53595 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2026-53595 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers target the `/user-setup/` endpoint with a crafted invite-hash path, such as `/user-setup/%20/9999999999`, to bypass authorization and access the user setup wizard without authentication. Successful exploitation may allow them to reset credentials for an activated user and gain account or administrative access.

## Timeline

- 2026-07-20: CVE Published. CVE-2026-53595 is published to NVD.
- 2026-09-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-53595 for the first time.
- 2026-09-17: Rule Released. CrowdSec releases a rule to detect CVE-2026-53595 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53595.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-53595) follows observed exploitation activity for CVE-2026-53595. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.