FreeScout's public endpoint POST /user-setup/{hash}/{invite_sent_at} selects a user account by invite_hash without authentication, then overwrites that account's email and password and logs in as it. On MySQL/MariaDB, VARCHAR equality ignores trailing spaces, so a URL-encoded space matches the empty string invite_hash set after activation, causing the lowest-id activated user to be selected. The expiry check decrypts invite_sent_at with the target's password hash, but decryption failure returns the raw input, allowing a plaintext numeric value to bypass the time-to-live check. This enables an anonymous attacker to take over the lowest-id activated account, potentially an administrator. The issue is fixed in FreeScout version 1.8.224.

An unauthenticated attacker can fully compromise the lowest-id activated FreeScout account by resetting its email and password and authenticating as that user. This can lead to full account takeover including administrative privileges if the lowest-id account is an administrator. The vulnerability allows complete confidentiality, integrity, and limited availability impact on the affected system.

Upgrade FreeScout to version 1.8.224 or later, which contains the fix for this vulnerability. There is no indication of an official patch or temporary workaround other than upgrading. Users should verify they are not running affected versions prior to 1.8.224.