CVE-2026-53595 – Authentication Bypass / Account Takeover – FreeScout Help Desk prior to 1.8.224

Summary

CVE-2026-53595 is a critical authentication bypass vulnerability in FreeScout, an open-source PHP/Laravel-based help desk and shared inbox application. An unauthenticated remote attacker can exploit a public account-setup endpoint to permanently overwrite the credentials of the lowest-ID activated user account — which may be an administrator — and immediately authenticate as that account. The vulnerability carries a CVSS 3.1 base score of 9.4 (Critical).

Technical details

• Root cause: Two compounding logic flaws exist in the public endpoint POST /user-setup/{hash}/{invite_sent_at} (OpenController@userSetupSave): no authentication is required to access the endpoint, and account selection relies solely on the invite_hash column, which FreeScout sets to an empty string after a user activates their account.
• MySQL/MariaDB trailing-space bypass: On MySQL and MariaDB, VARCHAR equality comparisons ignore trailing spaces. Submitting a single URL-encoded space (%20) as the {hash} parameter therefore matches the stored empty invite_hash and resolves to the lowest-ID activated user.
• Expiry guard bypass: The endpoint’s time-to-live check calls Helper::decrypt on the {invite_sent_at} URL parameter. When decryption fails, the function silently returns its raw input unchanged. A plaintext numeric value (e.g., 9999999999) therefore passes the expiry check with no knowledge of any account secret.
• Attack flow: An attacker first issues GET /user-setup/%20/9999999999 to retrieve the victim’s email address and a valid CSRF token, then POSTs attacker-chosen credentials to that same endpoint. The target account’s email and password are permanently overwritten and the attacker is logged in immediately.
• Impact: Full, persistent account takeover of the lowest-ID activated FreeScout user. If that account holds administrator privileges, the attacker gains unrestricted access to all support tickets, customer correspondence, mailbox configuration, and system settings.

Affected software

• FreeScout (freescout-help-desk/freescout) versions ≤ 1.8.223 running on MySQL or MariaDB
• PostgreSQL-backed installations are not affected by this specific attack chain
• Installations where the sole account present is the original installer administrator are also not affected

Severity

• CVSS v3.1 Base Score: 9.4 (Critical)
• Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Mitigation and recommended actions

• Immediate: Upgrade FreeScout to version 1.8.224 or later, which contains the vendor-provided fix addressing this vulnerability.
• If immediate patching is not possible, restrict network access to the /user-setup/ endpoint at the web server or firewall level as a temporary mitigation until the upgrade can be applied.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-53595 at NIST
• Vendor Security Advisory (GHSA-jqj5-r72v-v29g)