Authentication Bypass in FreeScout Help Desk by FreeScout

CVE-2026-53595

What is CVE-2026-53595?

An vulnerability in the FreeScout Help Desk application allows an unauthenticated attacker to manipulate user accounts. Exploiting the ‘POST /user-setup/{hash}/{invite_sent_at}’ endpoint, attackers can change the email address and password of any user account by solely relying on the invite_hash parameter, eliminating the need for authentication. This exploitation is due to MySQL's behavior with trailing spaces in VARCHAR fields, which permits the selection of the lowest user ID upon matching an empty invite_hash. Additionally, weak decryption logic allows the attacker to bypass time-to-live checks by using a plaintext numeric value. This flaw was addressed in version 1.8.224.

References