CVE-2026-41902

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-character random invite_hash to set a new user's password. The endpoint performs no expiration check — the hash remains valid indefinitely until consumed. Combined with realistic hash-leakage scenarios (forwarded invite emails, HTTP referrer to external CDNs on the setup page, server-side log exposure, abandoned invite emails in shared inboxes), this enables unauthenticated permanent account takeover months or years after invite issuance. If the leaked invite was sent to an admin, the takeover yields admin access. This issue has been patched in version 1.8.217.

• CWE-613

• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-hqff-cwx7-3jpm
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-hqff-cwx7-3jpm

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41897Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
• CVE-2026-41898rust-openssl provides OpenSSL bindings for the Rust programm…5.3
• CVE-2026-41899Coolify is an open-source and self-hostable tool for managin…6.5
• CVE-2026-4190A vulnerability was detected in JawherKl node-api-postgres u…7.3
• CVE-2026-41900OpenLearnX is an open-source, decentralized learning and ass…10
• CVE-2026-41901Thymeleaf is a server-side Java template engine for web and …9
• CVE-2026-41903FreeScout is a free help desk and shared inbox built with PH…5.4
• CVE-2026-41904FreeScout is a free help desk and shared inbox built with PH…7.6
• CVE-2026-41905FreeScout is a free help desk and shared inbox built with PH…7.7
• CVE-2026-41906FreeScout is a free help desk and shared inbox built with PH…7.1
• CVE-2026-41907uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs…7.5
• CVE-2026-41908OpenClaw before 2026.4.20 contains a scope enforcement bypas…6.5