CVE-2026-41902 is a critical vulnerability in FreeScout (a PHP Laravel-based help desk software) where the /user-setup/{hash} endpoint accepts a 60-character invite_hash to set a new user's password but does not enforce any expiration on this hash. Because the hash remains valid indefinitely until used, leaked invite hashes (via forwarded emails, HTTP referrers, server logs, or abandoned invites) can be exploited by unauthenticated attackers to permanently take over user accounts, including admin accounts if the invite was for an administrator. This vulnerability is classified under CWE-613 (Insufficient Session Expiration). The vulnerability is patched in FreeScout version 1.8.217.

An attacker who obtains a leaked invite_hash can permanently take over the associated user account without authentication. If the compromised invite belongs to an admin user, the attacker gains full administrative access to the system. This leads to complete confidentiality and integrity compromise of the affected FreeScout instance. Availability is not impacted. The CVSS v3.1 score is 9.1 (critical), reflecting the network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

Upgrade FreeScout to version 1.8.217 or later, where this vulnerability has been patched by implementing expiration checks on the invite_hash. Until upgraded, treat invite emails as highly sensitive and avoid forwarding or exposing them. Review and revoke any outstanding invite hashes if possible. Patch status is not explicitly stated in the vendor advisory but the description confirms the issue is fixed in version 1.8.217.