CVE-2026-41902 - Vulnerability Analysis

Overview

FreeScout < 1.8.217 contains an authentication bypass caused by lack of expiration check on /user-setup/{hash} invite_hash, letting unauthenticated attackers perform permanent account takeover, exploit requires leaked invite hash.

Severity & Score

Impact

Unauthenticated attackers can permanently take over user accounts, including admin accounts if the invite was for an admin.

Mitigation

Update to version 1.8.217 or later.

References

• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-hqff-cwx7-3jpm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner