FreeScout EUVD-2026-46094

Requires a FreeScout instance older than 1.8.224 backed by MySQL or MariaDB (the trailing-space VARCHAR equality behavior is essential - other databases may not match the empty invite_hash to %20). At least one user must already have activated their account so that invite_hash equals the empty string, and the takeover targets specifically the lowest-id activated account. The public /user-setup/{hash}/{invite_sent_at} endpoint must be reachable by the attacker. Limiting factors: exploitation grants control of only one account (the lowest activated id), which is an administrator only if an admin was created via invitation rather than initial install; the legitimate user is locked out, making the intrusion noticeable.

All signals point to genuine high priority. The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L (9.4) describes fully remote, unauthenticated, low-complexity exploitation with no user interaction, which the description corroborates precisely - the endpoint is public and no cookie or session is needed. Confidentiality and integrity are High because the attacker gains full control of a support agent or admin mailbox; availability is Low because the legitimate user is locked out of that single account. No EPSS score, KEV listing, SSVC decision, or POC was supplied, so there is currently no evidence of active or automated exploitation; exploitation status is 'no public exploit identified at time of analysis.' However, the technique is deterministic, requires no brute force, and is fully documented in the advisory, so real-world weaponization difficulty is very low. The main uncertainty is which account gets taken over - it is the lowest-id activated user, which is often an early admin but is deployment-dependent.

An attacker with only network access to the FreeScout web interface sends POST /user-setup/%20/9999999999 with a chosen email and password in the body. The trailing-space hash matches the empty invite_hash of the lowest-id activated account and the plaintext timestamp bypasses the expiry check, so the server overwrites that account's credentials and logs the attacker in as a support agent or administrator. No POC was provided, but the attack requires no authentication, no user interaction, and no special tooling beyond an HTTP client.