CVE-2026-53595

FreeScout prior to v1.8.224 is vulnerable to anonymous account takeover via POST /user-setup/{hash}/{invite_sent_at}. The endpoint authenticates solely by invite_hash; an attacker can overwrite the target account’s email and password and log in without authentication. After activation, invite_has...