CVE-2026-41902: FreeScout: Non-Expiring User Setup Invite Hash Allows Account Takeover
FreeScout versions before 1.8.217 accept a user-setup invite hash that never expires, so a leaked invitation can be used months or years later to set a password. GitHub's CNA scored the issue 9.1 (critical, CVSS 3.1) and classified it as CWE-613. The record states the issue is patched in 1.8.217 and that it is not listed in CISA KEV.
Overview
FreeScout is a free help desk and shared inbox built on the Laravel framework. According to the GitHub security advisory, versions before 1.8.217 expose a user-setup endpoint whose invite hash does not expire until it is used, so a leaked invitation can still set a password long after it was issued.
Impact
- Account takeover: a party holding a leaked invite hash may be able to set a new password for the associated account without being logged in.
- Administrative access risk: if the invitation was sent to an administrator, the takeover grants administrative access.
- Long exposure window: because the hash has no expiration check, leaked invitations remain usable for months or years.
The CNA scored the issue 9.1 under CVSS 3.1, with high confidentiality and integrity impact and no availability impact.
Affected products and versions
The record identifies FreeScout versions prior to 1.8.217 as affected. The structured affected list in the record is empty, so no further product or version detail is confirmed.
Exploitation status
The record shows the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The record includes an EPSS probability of 0.0042 with a percentile of 0.34566.
Remediation and mitigation
- Upgrade FreeScout to version 1.8.217, which the release tag identifies as the release containing the fix.
- Until the upgrade is done, review pending user invitations and remove those no longer needed, where the product allows it.
- Review administrator accounts and recent password changes for anything unexpected.
- Reduce the chance of invitation leakage by restricting who can access invitation emails and setup pages, and by reviewing third-party resources loaded on those pages.
Detection guidance
- Review web server and application logs for requests to user setup paths that come from unexpected sources or occur long after invitations were issued.
- Look for password changes on accounts whose invitations were old or never accepted, with particular attention to administrator accounts.
- Compare account changes with the original invitation dates recorded by the application.
Limitations of the available information
The record does not describe the exact technical change made in 1.8.217, including whether invitations issued before the update are invalidated. The structured affected and fixes lists are empty, and the source status is recorded as Deferred without further explanation. The exploitation data is limited to the KEV and EPSS fields.
Frequently asked questions
Is this FreeScout vulnerability being actively exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which version fixes the issue?
The record states the issue is patched in FreeScout version 1.8.217.
What should administrators do if they cannot upgrade right away?
Review pending invitations, check administrator accounts and recent password changes, and limit exposure of invitation emails and setup pages until the upgrade is applied.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.