CVE-2026-41902 — AI Deep Analysis Summary

🚨 **Essence**: FreeScout invite links **never expire**. 📉 **Consequences**: Attackers can hijack accounts months/years later. Admin takeover possible if admin invite is leaked. 💥 **Impact**: Full account compromise.

🛡️ **CWE**: CWE-613 (Insufficient Session Expiration). 🔍 **Flaw**: `/user-setup/{hash}` endpoint accepts 60-char `invite_hash` without checking expiration. Hash remains valid until consumed.

📦 **Product**: FreeScout (PHP Laravel Help Desk). 📅 **Affected**: Versions **< 1.8.217**. ✅ **Fixed**: Version 1.8.217+.

🔓 **Privileges**: Unauthenticated access. 👑 **Data**: If admin invite leaked → **Admin Privileges**. If user invite leaked → **User Account Control**. 📧 **Scope**: Permanent account takeover.

⚡ **Threshold**: LOW. 🚫 **Auth**: None required. 📝 **Config**: Only needs a leaked invite hash. 📬 **Leak Sources**: Forwarded emails, CDN headers, server logs, shared inbox archives.

🚫 **Public Exp?**: No PoC provided in data. 🌍 **Wild Exp**: Theoretical. Relies on finding old leaked hashes. Not automated/scripted yet based on current info.

🔍 **Check**: Scan for FreeScout instances. 📂 **Verify**: Check version number (< 1.8.217). 📧 **Audit**: Review invite logs for non-expiring hashes. 🕵️ **Monitor**: Look for unauthorized password resets via invite links.

✅ **Fixed**: Yes. 📥 **Patch**: Upgrade to **FreeScout 1.8.217** or later. 🔗 **Ref**: GitHub Security Advisory GHSA-hqff-cwx7-3jpm.

🛑 **Workaround**: Manually expire old invite hashes. 🧹 **Clean**: Delete unused invite emails from shared inboxes/logs. 🚫 **Block**: Restrict access to `/user-setup/` if possible.…

🔥 **Priority**: HIGH. 📈 **CVSS**: 9.8 (Critical). 🛡️ **Action**: Patch immediately. 🚨 **Reason**: Permanent account takeover risk with no auth needed. Admin compromise is a critical threat.