Potheeswaran 
A newly disclosed critical vulnerability in the open-source FreeScout helpdesk platform allows any anonymous attacker to hijack a support agent or even an administrator account using nothing more than a single URL-encoded space character.
Tracked as CVE-2026-53595 and rated critical with a CVSS score of 9.4, the flaw was published as GHSA-jqj5-r72v-v29g and affects all FreeScout versions up to 1.8.223, with a fix landing in 1.8.224.
The root cause lies in the public endpoint POST /user-setup/{hash}/{invite_sent_at}, handled by OpenController@userSetupSave, which identifies target accounts solely by matching the invite_hash database column.
Once a user activates their account, FreeScout resets invite_hash to an empty string. On MySQL and MariaDB, VARCHAR equality comparisons silently ignore trailing whitespace, meaning a request containing a single %20 character matches.
The stored empty value and selects the lowest-ID activated user in the system, typically the first agent invited, or an administrator if a second one was ever added.
Compounding the flaw, the endpoint’s time to live safeguard is equally broken. The isInviteExpirationValid function decrypts the invite_sent_at parameter using the target account’s password hash before checking expiry,
FreeScout’s Helper::decrypt function fails open: when decryption throws an exception, it silently returns the raw, unencrypted input instead of rejecting the request.
An attacker can simply supply a plaintext far-future timestamp like 9999999999, which passes the is_numeric and expiry checks without any secret key whatsoever.
Exploitation requires no cookies, sessions, or prior interaction. A researcher demonstrated the attack by sending GET /user-setup/%20/9999999999, which returned a 200 response pre-filled with the victim account’s real email address confirming account selection before any write occurs.
A follow-up POST request with attacker-controlled email and password fields, alongside a valid CSRF token, overwrites the victim’s credentials and immediately logs the attacker in via Auth::guard()->login(), all from a completely clean session that never held a cookie.
The impact scales with who occupies the lowest-ID activated slot. If it’s a support agent, the attacker gains durable access to that agent’s mailbox, customer conversations, and data-deletion capabilities.
If it’s an administrator, the result is full instance compromise, with the original account owner permanently locked out since their real credentials are destroyed in the process.
PostgreSQL-backed FreeScout deployments are not affected, since PostgreSQL enforces strict VARCHAR equality without space-trimming behavior.
Installations where the only account is the original installer administrator are also safe, since that account retains a NULL invite_hash rather than an empty string and cannot be matched by the query.
Researcher Jan Kahmen of turingpoint, who is credited with the discovery, verified the exploit live against a Docker-based FreeScout 1.8.223 instance running MariaDB in default configuration.
The vulnerability arrives roughly four months after separate critical FreeScout flaws, including a zero-click remote code execution bug dubbed Mail2Shell, rattled the project’s security posture earlier in 2026.
Administrators running MySQL or MariaDB backends should upgrade to FreeScout 1.8.224 immediately or restrict external access to the /user-setup/ endpoint at the firewall level as an interim measure.
About the Author
