Read the docs
TI-2026-30304 Aliases CVE-2026-41902

FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks

Priority HIGH 80CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-character random invite_hash to set a new user's password. The endpoint performs no expiration check — the hash remains valid indefinitely until consumed. Combined with realistic hash-leakage scenarios (forwarded invite emails, HTTP referrer to external CDNs on the setup page, server-side log exposure, abandoned invite emails in shared inboxes), this enables unauthenticated permanent account takeover months or years after invite issuance. If the leaked invite was sent to an admin, the takeover yields admin access. This issue has been patched in version 1.8.217.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00246 15th percentileScored 2026-11-07
Fix Fixed freescout (freescout-help-desk): 1.8.217

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
freescout-help-deskfreescoutbefore 1.8.2171.8.217Patch availableCNA
  • freescout Vendorfreescout-help-desk Affected before 1.8.217 Fixed in 1.8.217 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*——freescout-help-desk

Remediation

  • Fix · CNA freescout (freescout-help-desk) Fixed in 1.8.217

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41902

References

Other 2

  • TI-2026-38652 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL CVSS 3.1CRITICAL 9.4
  • TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-29249 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVSS 4.0HIGH 8.9
  • TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
  • TI-2026-38648 FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails CVSS 3.1HIGH 8.6
  • TI-2026-25245 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) CVSS 3.1CRITICAL 9.3
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences