Executive brief
FreeScout is an open-source help desk and shared inbox platform. A vulnerability in the user setup process allows an unauthenticated attacker to take over the account of a support agent or administrator. By exploiting this flaw, an attacker can change the account's email and password, gaining full access to customer communications and sensitive data while locking out the legitimate user.
Technical details
An authentication bypass and account takeover vulnerability exists in FreeScout's `OpenController@userSetupSave` endpoint. The application identifies accounts using an `invite_hash` column which is set to an empty string after user activation. On MySQL/MariaDB backends, trailing space equality allows a URL-encoded space (`%20`) to match these empty strings, selecting the first activated user (often an admin or agent). Additionally, the `isInviteExpirationValid` check can be bypassed because the decryption helper returns raw input upon failure, allowing a plaintext numeric timestamp to satisfy the expiry logic. An attacker can use a crafted POST request to overwrite the target's credentials and automatically log in. This issue is fixed in version 1.8.224.
Affected products
- freescout-help-desk FreeScout < 1.8.224
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD