EUVD-2026-46094Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Public endpoint reachable over network with no auth or interaction and deterministic technique gives AV:N/AC:L/PR:N/UI:N; full account control yields C:H/I:H, and lockout of one account gives A:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/{hash}/{invite_sent_at} (OpenController@userSetupSave) selects the target account solely by its invite_hash column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets invite_hash to the empty string. On MySQL and MariaDB, VARCHAR equality ignores trailing spaces, so a single URL-encoded space (%20) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts invite_sent_at with the target's password hash, but Helper::decrypt returns its raw input unchanged when decryption fails. A plaintext numeric value such as 9999999999 therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.
AnalysisAI
Anonymous account takeover in FreeScout help desk before 1.8.224 lets an unauthenticated attacker seize the lowest-id activated agent or administrator account by abusing the public POST /user-setup/{hash}/{invite_sent_at} endpoint. By supplying a single URL-encoded space as the invite hash and a plaintext numeric timestamp, the attacker overwrites the target's email and password and is logged in as that user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a FreeScout instance older than 1.8.224 backed by MySQL or MariaDB (the trailing-space VARCHAR equality behavior is essential - other databases may not match the empty invite_hash to %20). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with only network access to the FreeScout web interface sends POST /user-setup/%20/9999999999 with a chosen email and password in the body. The trailing-space hash matches the empty invite_hash of the lowest-id activated account and the plaintext timestamp bypasses the expiry check, so the server overwrites that account's credentials and logs the attacker in as a support agent or administrator. … |
| Remediation | Vendor-released patch: 1.8.224 - upgrade all FreeScout instances to 1.8.224 or later, which fixes the invite_hash matching and expiry-decryption logic, per advisory GHSA-jqj5-r72v-v29g (https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all deployments to confirm FreeScout version and internet accessibility; immediately restrict network access to the POST /user-setup/{hash}/{invite_sent_at} endpoint via Web Application Firewall rules, network segmentation, or IP filtering. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.
Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that
Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers
FreeScout is a self-hosted help desk and shared mailbox. Rated critical severity (CVSS 9.0), this vulnerability is remot
FreeScout is a self-hosted help desk and shared mailbox. Rated high severity (CVSS 8.0), this vulnerability is remotely
FreeScout is an open source help desk and shared inbox built with PHP. Rated high severity (CVSS 7.1), this vulnerabilit
FreeScout is a free, self-hosted help desk and shared mailbox. Rated medium severity (CVSS 6.3), this vulnerability is r
FreeScout is a free, self-hosted help desk and shared mailbox. Rated medium severity (CVSS 6.1), this vulnerability is r
A stored cross-site scripting (XSS) vulnerability exists in FreeScout help desk software versions 1.8.208 and below, whe
Arbitrary file write in FreeScout (prior to 1.8.215) allows authenticated administrators to achieve remote code executio
Unauthenticated account takeover in FreeScout versions prior to 1.8.217 allows remote attackers to gain permanent access
Unauthenticated remote attackers can access administrative diagnostic endpoints in FreeScout versions prior to 1.8.213,
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today