What is the CVSS score of CVE-2026-53595?

CVE-2026-53595 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of FreeScout are affected by CVE-2026-53595?

FreeScout help desk versions before 1.8.224 contain a critical account takeover vulnerability allowing unauthenticated attackers to seize administrative and agent accounts with a simple public…. A patch is available.

Is there a public PoC exploit available for CVE-2026-53595?

Yes, a public proof-of-concept exploit is available for CVE-2026-53595. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-53595?

Within 24 hours: audit all deployments to confirm FreeScout version and internet accessibility; immediately restrict network access to the POST /user-setup/{hash}/{invite_sent_at} endpoint via Web Application Firewall rules, network segmentation, or IP filtering. Within 7 days: implement comprehensive logging and alerting for the /user-setup endpoint targeting requests with single-space hash values or numeric timestamps; audit all activated administrator and agent accounts for unauthorized access or password changes; terminate all existing sessions. Within 30 days: monitor the official FreeScout advisory for patch release; as interim protection, move FreeScout behind VPN or IP allowlist if internet-facing; prepare to upgrade to version 1.8.224 or later as soon as it is released.

FreeScout CVE-2026-53595

EUVD-2026-46094 CRITICAL

Improper Handling of Case Sensitivity (CWE-178)

2026-07-20 GitHub_M

Information Disclosure Freescout Freescout Help Desk

9.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

9.4 CRITICAL

Public endpoint reachable over network with no auth or interaction and deterministic technique gives AV:N/AC:L/PR:N/UI:N; full account control yields C:H/I:H, and lockout of one account gives A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 20, 2026 - 23:18 EUVD

Analysis Generated

Jul 20, 2026 - 20:46 vuln.today

CVE Published

Jul 20, 2026 - 20:14 cve.org

CRITICAL 9.4

DescriptionCVE.org

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/{hash}/{invite_sent_at} (OpenController@userSetupSave) selects the target account solely by its invite_hash column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets invite_hash to the empty string. On MySQL and MariaDB, VARCHAR equality ignores trailing spaces, so a single URL-encoded space (%20) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts invite_sent_at with the target's password hash, but Helper::decrypt returns its raw input unchanged when decryption fails. A plaintext numeric value such as 9999999999 therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.

AnalysisAI

Anonymous account takeover in FreeScout help desk before 1.8.224 lets an unauthenticated attacker seize the lowest-id activated agent or administrator account by abusing the public POST /user-setup/{hash}/{invite_sent_at} endpoint. By supplying a single URL-encoded space as the invite hash and a plaintext numeric timestamp, the attacker overwrites the target's email and password and is logged in as that user. No public exploit is identified at time of analysis, but the mechanics are fully disclosed in the GitHub advisory and CVSS is 9.4.

Technical ContextAI

FreeScout is an open-source PHP/Laravel shared-inbox and help-desk application (cpe:2.3:a:freescout-help-desk:freescout). The invite-activation flow in OpenController@userSetupSave locates the account to activate purely by its invite_hash column and then rewrites that row's credentials. The flaw class is CWE-178 (improper handling of case/canonicalization): on MySQL and MariaDB, CHAR/VARCHAR equality comparisons pad and ignore trailing spaces, so the stored empty-string invite_hash (set once a user has activated) equals a value of %20 (one trailing space). A second defect compounds it: the expiry check calls Helper::decrypt on invite_sent_at using the target's password hash, but Helper::decrypt returns its raw input unchanged on decryption failure, so a plaintext value like 9999999999 satisfies the time-to-live guard without any secret. Together these turn a one-time invitation endpoint into an unauthenticated credential-reset primitive against an already-activated account.

RemediationAI

Vendor-released patch: 1.8.224 - upgrade all FreeScout instances to 1.8.224 or later, which fixes the invite_hash matching and expiry-decryption logic, per advisory GHSA-jqj5-r72v-v29g (https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g). If an immediate upgrade is not possible, block or restrict access to the /user-setup/ route at the reverse proxy or WAF (allowing it only from trusted networks during genuine onboarding windows), which prevents exploitation at the cost of breaking invitation self-activation until re-enabled. As a database-level hardening measure, ensure no activated account retains a non-empty predictable invite_hash and consider auditing for accounts whose email was recently changed. After patching, treat any pre-patch takeover as possible: rotate credentials and review admin/agent account changes and login history for the lowest-id activated user.