What is the CVSS score of CVE-2026-41902?

CVE-2026-41902 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of FreeScout are affected by CVE-2026-41902?

FreeScout versions before 1.8.217 contain a critical account takeover vulnerability affecting all user accounts, including administrators, through non-expiring invite tokens that remain valid…. A patch is available.

How to fix or mitigate CVE-2026-41902?

Within 24 hours: identify all FreeScout instances and confirm versions currently deployed; audit access logs and email forwarding records for leaked invite links. Within 7 days: upgrade all FreeScout deployments to version 1.8.217 or later; rotate passwords for all user accounts, particularly administrators; revoke all outstanding invite tokens through the application database if version 1.8.217 is unavailable. Within 30 days: implement email security controls to prevent invite link leakage (disable referrer headers, restrict CDN logging); conduct security awareness training on phishing and link compromise; perform access review of all user accounts created via invite mechanism.

FreeScout CVE-2026-41902

EUVD-2026-28405 CRITICAL

Insufficient Session Expiration (CWE-613)

2026-05-07 GitHub_M

Information Disclosure Freescout

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 07, 2026 - 20:02 EUVD

Source Code Evidence Fetched

May 07, 2026 - 19:45 vuln.today

Analysis Generated

May 07, 2026 - 19:45 vuln.today

CVE Published

May 07, 2026 - 18:03 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-character random invite_hash to set a new user's password. The endpoint performs no expiration check - the hash remains valid indefinitely until consumed. Combined with realistic hash-leakage scenarios (forwarded invite emails, HTTP referrer to external CDNs on the setup page, server-side log exposure, abandoned invite emails in shared inboxes), this enables unauthenticated permanent account takeover months or years after invite issuance. If the leaked invite was sent to an admin, the takeover yields admin access. This issue has been patched in version 1.8.217.

AnalysisAI

Unauthenticated account takeover in FreeScout versions prior to 1.8.217 allows remote attackers to gain permanent access to user accounts, including admin accounts, via non-expiring invite tokens. The /user-setup/{hash} endpoint accepts 60-character invite_hash values with no time-based expiration, remaining valid indefinitely until consumed. Attackers who obtain leaked invite links through forwarded emails, HTTP referrer logs, CDN access logs, or archived messages can set passwords for target accounts months or years post-issuance. CVSS 9.1 (Critical) with network vector and no authentication required. Patched in version 1.8.217 with 7-day invite expiration. EPSS and KEV data not available; no public exploit code identified at time of analysis.

Technical ContextAI

FreeScout is a PHP Laravel-based help desk and shared inbox application (CPE: cpe:2.3:a:freescout-help-desk:freescout). The vulnerability exploits CWE-613 (Insufficient Session Expiration) in the user invitation flow. When administrators create user accounts, the system generates a 60-character cryptographically random invite_hash token and emails a setup link containing this hash to the new user. The /user-setup/{hash} endpoint validates the hash against stored invite records but performs no timestamp check or expiration logic. The token remains valid in the database indefinitely until a password is set, treating the invite as a permanent bearer credential rather than a time-limited one-time password reset mechanism. This design flaw converts what should be ephemeral onboarding credentials into persistent account takeover vectors. The Laravel framework provides session management primitives but application-layer expiration logic must be explicitly implemented by developers. The 1.8.217 patch introduces a 7-day TTL on invite tokens, aligning with OWASP recommendations for password reset and invitation link lifetimes.

RemediationAI

Upgrade to FreeScout version 1.8.217 or later immediately. The patch implements a 7-day expiration window for user invite links as confirmed in the release notes: 'Make user invite link expirable after 7 days' (Security: GHSA-hqff-cwx7-3jpm). Download the patched version from the official GitHub release page at https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217 and follow the standard FreeScout upgrade procedure documented in the project wiki. After upgrading, audit user accounts for unexpected password changes or access patterns that may indicate prior exploitation. Revoke and regenerate invite links for any pending user setups issued before the patch. If immediate patching is not possible, implement network-level access controls to restrict /user-setup/* endpoints to trusted IP ranges or internal networks only via nginx/Apache rewrite rules or Web Application Firewall policies (trade-off: legitimate remote users cannot complete setup). Alternatively, temporarily disable new user invitation functionality and use manual password reset flows via direct database manipulation (trade-off: breaks normal onboarding workflow, requires database access). Review web server access logs and application logs for suspicious /user-setup/ endpoint access with old timestamps to identify potential historical compromise. All workarounds impose significant operational overhead; patching is the only complete remediation.