FreeScout is a free help‑desk and shared‑inbox solution built with PHP’s Laravel framework. Before version 1.8.224, its public POST endpoint `/user‑setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) locates a target account solely by the value of its `invite_hash` column, overwrites that account’s email and password, and logs in as it. No authentication cookie or prior session is required. After a user activates, FreeScout sets the `invite_hash` field to an empty string. In MySQL and MariaDB the equality comparison for `VARCHAR` ignores trailing spaces, so a single URL‑encoded space (`%20`) matches the stored empty string and selects the lowest‑ID activated user. The route’s expiry guard decrypts `invite_sent_at` using the target’s password hash, but `Helper::decrypt` returns the raw input unchanged when decryption fails; a plaintext numeric value such as `9999999999` therefore bypasses the time‑to‑live check. The result is that an anonymous attacker can set a new email and password for the lowest‑ID activated FreeScout account (a support agent or an administrator added by invitation) and authenticate as that account, effectively gaining account‑takeover privileges.

The vulnerability affects the FreeScout help desk application published by freescout-help-desk. All releases prior to 1.8.224 are affected; upgrading to version 1.8.224 or newer removes the open /user-setup route that allowed the exploit.

The CVSS score of 9.4 indicates a critical severity, and the lack of authentication or session requirements means that the exploit can be performed over an open internet connection solely by sending a crafted POST request to /user-setup with a space in the hash and a timestamp value such as 9999999999. The exploit path is straightforward, the required conditions are minimal, and although the EPSS score of < 1% indicates a low probability of exploitation, the simplicity of the attack and the lack of mitigation make it a high‑risk scenario. The vulnerability is not listed in the CISA KEV catalog.