Skip to main content
Public proof of concept

CVE-2026-53595

A public proof of concept exists; no exploitation attested.

  • Published2026-07-20
  • WeaknessCWE-178 · CWE-287 · CWE-640

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.

Timeline

dates in UTC
  1. 2026-07-2021:16CVE publishedNVD

Versions per branch

Products declared by the CNA

As GitHub_M, the CNA that assigned this CVE, declared them in the CVE record; versions as written. NVD lists no product for this CVE yet: this is the only product data so far.

  • freescout-help-desk freescout
    Affected
    • = < 1.8.224no fix stated

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2026-07-20

Neither OSV.dev nor the vendor advisories we read list affected versions for CVE-2026-53595 yet.

Full record on NVD

Fix

No fix published by the sources we read yet. NVD record

Detection

read 2026-11-01 01:02 UTC
Nuclei template
available
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

  • NVDCVE recordread 2026-10-25
  • CISA-ADPSSVC decisionpoc2026-07-21
  • CNACVSS 3.19.4known since 2026-10-25
  • CNAweakness (CWE)CWE-178, CWE-287, CWE-640known since 2026-10-25
  • FIRST EPSSEPSS score1.9 %2026-11-09
  • PoC-in-GitHubproof of concept1known since 2026-11-01
  • ProjectDiscoverydetectionread 2026-11-09

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Published
2026-07-20
Last Modified
2026-10-24
NVD status
Deferred

Frequently asked questions

What is CVE-2026-53595?

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target's password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix.

Is CVE-2026-53595 actively exploited?

A proof-of-concept exploit exists for CVE-2026-53595, but active exploitation has not been confirmed at this time.

What is the CVSS score for CVE-2026-53595?

CVE-2026-53595 has a CVSS v3 base score of 9.4 (CRITICAL severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.

Hear about the next vulnerability in your software

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record