CVE-2026-53595: FreeScout Auth Bypass Vulnerability

CVE-2026-53595 Overview

FreeScout is a free help desk and shared inbox application built on PHP's Laravel framework. CVE-2026-53595 is an authentication bypass in the public endpoint POST /user-setup/{hash}/{invite_sent_at}, handled by OpenController@userSetupSave. The endpoint selects the target account solely by its invite_hash column, then overwrites the account email and password before logging in as that user. No prior authentication or session is required. The flaw allows an anonymous attacker to hijack the lowest-id activated FreeScout account, which may be a support agent or an administrator added by invitation. Version 1.8.224 contains the fix.

Critical Impact
An unauthenticated remote attacker can take over an activated FreeScout account by sending a single crafted HTTP request, gaining full access to help desk data and, if an admin was invited, administrative control.

Affected Products

FreeScout help desk (all versions prior to 1.8.224)
Deployments backed by MySQL or MariaDB databases
Instances where at least one user has completed invitation activation

Discovery Timeline

2026-07-20 - CVE-2026-53595 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-53595

Vulnerability Analysis

The userSetupSave handler locates the target user by matching the URL-provided invite_hash against the invite_hash column in the users table. When a user completes activation, FreeScout resets invite_hash to an empty string rather than a null or unique sentinel. This design assumes empty strings cannot be matched by an attacker.

On MySQL and MariaDB, the default PADSPACE collation applied to VARCHAR columns ignores trailing whitespace during equality comparisons. A URL-encoded space (%20) in the {hash} path segment therefore matches the stored empty string. The query returns the activated user with the lowest primary key, which in many deployments is an administrator or lead agent. The vulnerability is classified as [CWE-178] Improper Handling of Case Sensitivity, extended here to whitespace normalization.

Root Cause

Two defects combine to enable full account takeover. First, invite_hash is not invalidated to a unique or null value after activation, leaving a collidable empty string in the column. Second, the expiry guard calls Helper::decrypt on the invite_sent_at parameter using the target account's password hash as the key, but Helper::decrypt returns the raw input unchanged when decryption fails. Supplying a plaintext numeric value such as 9999999999 satisfies the time-to-live check without any knowledge of the secret.

Attack Vector

An attacker sends a POST request to /user-setup/%20/9999999999 with form fields for a new email and password. The database query matches the lowest-id activated user due to the trailing-space collation behavior. FreeScout then overwrites that account's credentials and establishes an authenticated session for the attacker. Refer to the GitHub Security Advisory GHSA-jqj5-r72v-v29g for full technical details.

Detection Methods for CVE-2026-53595

Indicators of Compromise

HTTP POST requests to /user-setup/ paths containing URL-encoded whitespace such as %20 in the hash segment.
Unexpected email address or password changes on administrator or agent accounts without corresponding admin activity.
Successful authentication events immediately following a user-setup request from the same source IP.
New or altered login sessions originating from IP addresses not previously associated with the affected account.

Detection Strategies

Review web server and application logs for requests matching POST /user-setup/*/ where the hash path segment is empty, whitespace, or a single encoded character.
Query the users table for accounts whose updated_at or password timestamp changed without a corresponding administrator audit entry.
Correlate any userSetupSave invocation with the subsequent session establishment to identify unattended activations.

Monitoring Recommendations

Enable verbose access logging on the FreeScout front-end web server and forward logs to a central SIEM.
Alert on any HTTP 200 response to /user-setup/ requests after the site has moved past initial deployment.
Monitor for privilege changes and email address updates on administrator accounts in near real time.

How to Mitigate CVE-2026-53595

Immediate Actions Required

Upgrade all FreeScout instances to version 1.8.224 or later without delay.
Force a password reset for every user account, prioritizing administrators and agents added by invitation.
Invalidate all existing user sessions and API tokens after upgrading.
Review recent login and account modification history for signs of prior exploitation.

Patch Information

FreeScout version 1.8.224 remediates the flaw by ensuring invite_hash matches only non-empty values and by hardening the invite_sent_at expiry check so that decryption failures no longer return attacker-controlled input. Details are documented in the GitHub Security Advisory GHSA-jqj5-r72v-v29g.

Workarounds

Restrict access to the /user-setup/ route at a reverse proxy or web application firewall until the patch is applied.
Block requests where the {hash} path segment contains only whitespace, encoded whitespace, or fewer than a minimum character threshold.
Manually null out or randomize the invite_hash column values for already-activated users as a temporary database-level control.

bash

# Example NGINX rule to block empty or whitespace-only invite hashes
location ~ ^/user-setup/(%20|\s|)/ {
    return 403;
}