CVE-2026-41902: FreeScout Invite Hash Vulnerability Allows Permanent Account Takeover

The National Vulnerability Database has detailed CVE-2026-41902, a critical vulnerability in FreeScout, a PHP-based help desk and shared inbox system. Versions prior to 1.8.217 suffer from an insecure user setup endpoint, /user-setup/{hash}. This endpoint accepts a 60-character invite hash for setting a new user’s password but crucially lacks any expiration check. This means a leaked invite hash remains valid indefinitely, creating a permanent backdoor.

Attackers can exploit realistic hash leakage scenarios, such as forwarded invite emails, exposed HTTP referrers, server logs, or even abandoned emails in shared inboxes. This allows for unauthenticated account takeover months or even years after the initial invite was issued. If the compromised invite was for an administrator, the attacker gains full administrative control over the FreeScout instance.

This vulnerability, rated CVSS 9.1, has been patched in FreeScout version 1.8.217. Defenders using FreeScout must upgrade immediately to prevent potential long-term compromise. Organizations should also review their incident response plans for handling long-lived leaked credentials.