FreeScout < 1.8.224 - Invite Hash Authorization Bypass

FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invitehash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication. id: CVE-2026-53595 info:...

CVE-2023-52268

FreeScout End-User Portal Authentication Bypass Exploit CVE-2023-52268 Overview This exploit targets a vulnerability in the FreeScout End-User Portal Module versions below 1.0.65 that allows an attacker to bypass authentication through improper session token management. By generating and testing...

CVE-2026-53595_exploit

CVE-2026-53595 + CVE-2026-53593 — FreeScout Anonymous ATO → RCE Unauthenticated remote code execution in FreeScout ≤ 1.8.223 a Laravel help desk by chaining two flaws, both fixed in 1.8.224 : CVE-2026-53595 — anonymous account takeover. POST /user-setup/hash/invitesentat picks the account by its...

CVE-2026-28289

🚨 CVE-2026-28289 — “Mail2Shell” Zero-Click Unauthenticated RCE in FreeScout via Email Attachment Bypass 📖 Overview CVE-2026-28289 , nicknamed Mail2Shell , is a critical zero-click Remote Code Execution RCE vulnerability affecting FreeScout. An attacker can send a specially crafted email to a...

CVE-2026-107393

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...

CVE-2026-107393 FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...

CVE-2026-107393

Prior to version 1.8.235 , FreeScout (a self-hosted help desk) is vulnerable to Stored HTML Injection when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. Th...

CVE-2026-27636

Passive reconnaissance and fingerprinting tool for detecting FreeScout deployments and analyzing exposure related to CVE-2026-28289. This script focuses on safe infrastructure intelligence gathering rather than exploitation. It helps researchers and defenders understand how FreeScout instances ar...

CVE-2026-35584

CVE-2026-35584 POC - CVE-2026-35584 FreeScout Description Summary The endpoint GET /thread/read/conversationid/threadid does not require authentication and does not validate whether the given threadid belongs to the given conversationid. This allows any unauthenticated attacker to: Mark any threa...

Exploit for CVE-2026-53595

CVE-2026-53595 + CVE-2026-53593 — FreeScout Anonymous ATO →...

CVE-2026-53594

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53595

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-53596 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53596 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

EUVD-2026-46095

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53596 FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53593

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads Helper::$restrictedextensions is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST /uploads/uplo...

CVE-2026-53595

FreeScout prior to v1.8.224 is vulnerable to anonymous account takeover via POST /user-setup/{hash}/{invite_sent_at}. The endpoint authenticates solely by invite_hash; an attacker can overwrite the target account’s email and password and log in without authentication. After activation, invite_has...