CVE-2026-41902: FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-character random invitehash to set a new user's password. The endpoint performs no expiration check — the hash remains valid indefinitely until consumed. Combined with realistic hash-leakage scenarios (forwarded invite emails, HTTP referrer to external CDNs on the setup page, server-side log exposure, abandoned invite emails in shared inboxes), this enables unauthenticated permanent account takeover months or years after invite issuance. If the leaked invite was sent to an admin, the takeover yields admin access. This issue has been patched in version 1.8.217.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41902?
CVE-2026-41902 has a high severity rating due to the potential for permanent unauthenticated account takeover if the invite link is leaked.
How do I fix CVE-2026-41902?
To fix CVE-2026-41902, update FreeScout to version 1.8.217 or later, which addresses the vulnerability.
What are the consequences of CVE-2026-41902 if not mitigated?
If not mitigated, CVE-2026-41902 allows unauthorized users to gain access to accounts through leaked invite links.
Which versions of FreeScout are affected by CVE-2026-41902?
FreeScout versions prior to 1.8.217 are affected by CVE-2026-41902.
Is there a workaround for CVE-2026-41902 before I can update FreeScout?
There is no specific workaround for CVE-2026-41902; updating to the latest version is recommended as the best mitigation.