CVE-2026-53595: FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 30 Oct 2026.

VulnCheck KEV lists it since 30 Oct 2026. VulnCheck's own honeypots also recorded exploitation attempts.

How likely is exploitation in the next 30 days?

1.9%

EPSS score, percentile 80.2 of all scored records. A probability estimated by FIRST, not a report of exploitation.

CISA's SSVC assessment in the CVE record lists exploitation as poc.

How severe?

9.4 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

• < 1.8.224

Versions by product

Source: CISA KEV 2026.10.30, as of 30 Oct 2026; VulnCheck KEV, as of 31 Oct 2026; FIRST EPSS, as of 30 Oct 2026; CVE List, as of 31 Oct 2026. About the data.

Description

FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.

Source: CVE List, as of 31 Oct 2026. About the data.

What to do

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

This summary is based on the CVE record as of 31 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Source: CVE List, as of 31 Oct 2026. About the data.

Timeline