The vulnerability exists in the /user-setup/{hash} endpoint of the FreeScout help desk system. It allows a 60‑character random invitation hash to set a new user’s password without performing any expiration check. The hash remains valid indefinitely until it is used. This missing expiration logic is a manifestation of CWE‑613, Insecure Direct Object Reference. An attacker who obtains a leaked invitation link can create or recover an account at any time after the invitation has been issued, resulting in a permanent takeover. If the invitation was sent to an administrative user, the attacker gains full admin privileges. The impact is a complete compromise of confidentiality and integrity for the affected account and potentially the entire system. Availability is not directly affected, though an attacker could also use the account create arbitrary traffic or alter tickets.

All installations of FreeScout (freescout-help-desk:freescout) running a version earlier than 1.8.217 are affected. The vulnerability was fixed in the 1.8.217 release. No other FreeScout versions are known to have this issue.

The CVSS score of 9.1 reflects a high severity rating for remote, unauthenticated exploitation. The EPSS score is not available, but the absence of an expiration means that once a hash is leaked, it remains useful for an unlimited period, increasing the practical exploitation window. The vulnerability is not listed in the CISA KEV catalog, though it poses a significant risk in environments where invitation links can be communicated outside the ecosystem. An attacker requires only knowledge of a valid hash, which can arise from email leakage, referrer leakage, server logs or abandoned invites.