FreeScout CVE-2026-41902

Attacker must obtain a valid 60-character invite_hash value from a previously issued user invitation. Specific leakage vectors enabling this include: possession of forwarded invite emails from original recipients, access to email archives in shared/team mailboxes where invites were sent, HTTP server access logs containing full GET request URIs with hash parameters, CDN or proxy logs capturing referrer headers when invite setup pages load external resources, interception of unencrypted email traffic if SMTP TLS is not enforced, or social engineering of administrators to forward/share invite links. The target user account's password must not have been previously set via the invite link (hash is consumed on first use). No authentication is required to access the /user-setup/ endpoint (PR:N). No user interaction is required once the attacker has the hash (UI:N). The vulnerability affects default FreeScout configurations with no special features or settings required. Attack succeeds against any reachable FreeScout instance (network vector, AV:N) with standard user invitation functionality enabled. If the leaked invite was originally sent to an administrator account, successful exploitation yields admin-level access to the entire help desk system.

Real-world exploitation risk is HIGH despite no confirmed active exploitation (no KEV listing or public POC). The CVSS 9.1 score accurately reflects the technical severity: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), and high impact to confidentiality and integrity (C:H/I:H). The attack requires only obtaining a leaked invite URL, which is realistic through multiple documented channels: forwarded invite emails in uncontrolled mailboxes, HTTP referrer headers when invite pages load external CDN resources, server access logs containing full request URIs, email archives in shared/team inboxes, or phishing of support staff with access to invite history. The unlimited validity window dramatically increases exposure - a hash leaked in year one remains exploitable in year three. If the compromised invite targets an admin account, the attacker gains full control of the help desk system including access to all customer communications, sensitive tickets, and user data. The absence of EPSS data and POC code suggests low public awareness rather than low exploitability; the attack is trivial once a hash is obtained (simple HTTP POST to public endpoint). The 60-character random hash provides cryptographic strength against brute force but zero defense against leakage-based attacks. Organizations using FreeScout should treat this as an immediate patching priority, especially if invite emails have been sent over the past 12+ months, as those hashes remain weaponizable until the system is upgraded.

An attacker identifies a FreeScout instance via Shodan or target reconnaissance. Six months ago, the organization invited a new admin user via email to admin@example.com. That invite email was forwarded to a contractor's personal Gmail account for reference. The attacker compromises the contractor's email via credential stuffing and discovers the archived FreeScout invite containing the /user-setup/[60-char-hash] URL. The attacker visits the still-valid setup link, sets a new password for the admin account, and logs in with full administrative privileges. They now have access to all customer support tickets, email conversations, internal notes, user credentials, and system configuration. The attacker exfiltrates sensitive customer data, plants backdoor admin accounts, and maintains persistent access even after the original compromise is detected.