{
  "affected": [
    {
      "affectedData": [
        {
          "product": "freescout",
          "vendor": "freescout-help-desk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.224"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreeScout is a free help desk and shared inbox built with PHP\u0027s Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account\u0027s email and password and logs in as it. No authentication, cookie, or prior session is required. After a user activates, FreeScout sets `invite_hash` to the empty string. On MySQL and MariaDB, `VARCHAR` equality ignores trailing spaces, so a single URL-encoded space (`%20`) matches the stored empty string and selects the lowest-id activated user. The expiry guard decrypts `invite_sent_at` with the target\u0027s password hash, but `Helper::decrypt` returns its raw input unchanged when decryption fails. A plaintext numeric value such as `9999999999` therefore passes the time-to-live check without any secret. The result is that an anonymous attacker sets the email and password of the lowest-id activated FreeScout account (a support agent, or an administrator if one was added by invitation) and authenticates as that account. Version 1.8.224 contains a fix."
    },
    {
      "lang": "es",
      "value": "FreeScout es un help desk gratuito y una bandeja de entrada compartida construido con el framework Laravel de PHP. Antes de la versi\u00f3n 1.8.224, el endpoint p\u00fablico \u2019POST /user-setup/{hash}/{invite_sent_at}\u2019 (\u2019OpenController@userSetupSave\u2019) selecciona la cuenta objetivo \u00fanicamente por su columna \u2019invite_hash\u2019, luego sobrescribe el correo electr\u00f3nico y la contrase\u00f1a de esa cuenta e inicia sesi\u00f3n como ella. No se requiere autenticaci\u00f3n, cookie ni sesi\u00f3n previa. Despu\u00e9s de que un usuario se activa, FreeScout establece \u2019invite_hash\u2019 a la cadena vac\u00eda. En MySQL y MariaDB, la igualdad de \u2019VARCHAR\u2019 ignora los espacios finales, por lo que un solo espacio codificado en URL (\u2019%20\u2019) coincide con la cadena vac\u00eda almacenada y selecciona al usuario activado con el ID m\u00e1s bajo. El guardi\u00e1n de caducidad descifra \u2019invite_sent_at\u2019 con el hash de la contrase\u00f1a del objetivo, pero \u2019Helper::decrypt\u2019 devuelve su entrada bruta sin cambios cuando el descifrado falla. Un valor num\u00e9rico en texto plano como \u20199999999999\u2019 por lo tanto, pasa la verificaci\u00f3n de tiempo de vida sin ning\u00fan secreto. El resultado es que un atacante an\u00f3nimo establece el correo electr\u00f3nico y la contrase\u00f1a de la cuenta FreeScout activada con el ID m\u00e1s bajo (un agente de soporte, o un administrador si se a\u00f1adi\u00f3 uno por invitaci\u00f3n) y se autentica como esa cuenta. La versi\u00f3n 1.8.224 contiene una correcci\u00f3n."
    }
  ],
  "id": "CVE-2026-53595",
  "lastModified": "2026-10-24T20:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53595",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-21T13:20:35.944303Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-20T21:16:48.417",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jqj5-r72v-v29g"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-178"
        },
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-640"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}