CVE-2026-41902 Details
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-character random invite_hash to set a new user's password. The endpoint performs no expiration check — the hash remains valid indefinitely until consumed. Combined with realistic hash-leakage scenarios (forwarded invite emails, HTTP referrer to external CDNs on the setup page, server-side log exposure, abandoned invite emails in shared inboxes), this enables unauthenticated permanent account takeover months or years after invite issuance. If the leaked invite was sent to an admin, the takeover yields admin access. This issue has been patched in version 1.8.217.
A vulnerability in FreeScout prior to version 1.8.217 allows for permanent, unauthenticated account takeover by exploiting the user setup endpoint. The endpoint accepts a 60-character invite hash to reset a user's password but lacks an expiration check, leaving the hash valid indefinitely. This flaw can be exploited months or years after the invite is sent, especially if the hash is leaked through forwarded emails, server logs, or shared inboxes. If an admin's invite hash is compromised, the attacker gains admin access.
Users can update to FreeScout version 1.8.217 or later, where this vulnerability has been patched. The update is available on the FreeScout GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 7, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-hqff-cwx7-3jpm | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217 | [email protected] | Release NotesVendor |
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-hqff-cwx7-3jpm | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FreeScout | <= 1.8.216 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |