PT-2026-38547 · Freescout · Freescout

Whatisproblem · Published 2026-05-07 · Updated 2026-05-20 · CVE-2026-41902

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.217

Description The '/user-setup/{hash}' endpoint accepts a 60-character random invite hash to set a new user's password but does not perform an expiration check, allowing the hash to remain valid indefinitely until used. This can lead to unauthenticated permanent account takeover if the hash is leaked through forwarded emails, HTTP referrers to external CDNs, server-side logs, or abandoned emails in shared inboxes. If the leaked invite was intended for an administrator, the attacker can gain administrative access.

Recommendations Update to version 1.8.217.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-41902

Affected Products

Freescout

References · 12

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-hqff-cwx7-3jpm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41902 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217 · Note
• https://twitter.com/VulmonFeeds/status/2052558398193889417 · Twitter Post
• https://twitter.com/polsia/status/2053776052351324250 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2052478582291628197 · Twitter Post
• https://twitter.com/integ_sec/status/2057072613566926854 · Twitter Post
• https://t.me/cveNotify/162808 · Telegram Post
• https://twitter.com/infoflowcloud/status/2052479054788317478 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054358653503692968 · Twitter Post
• https://twitter.com/CVEnew/status/2052477956048470112 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054358654296461602 · Twitter Post