CVE-2026-53595

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.224

Description The public endpoint POST /user-setup/{hash}/{invite sent at} (OpenController@userSetupSave) allows an anonymous attacker to overwrite the email and password of the lowest-id activated account and authenticate as that user. This occurs because the system selects the target account based on the invite hash column. On MySQL and MariaDB, VARCHAR equality ignores trailing spaces, allowing a URL-encoded space (%20) to match an empty string. Additionally, the Helper::decrypt() function returns raw input when decryption fails, allowing a plaintext numeric value in the invite sent at variable to bypass the time-to-live check.

Recommendations Update to version 1.8.224.