The vulnerability in FreeScout's public endpoint POST /user-setup/{hash}/{invite_sent_at} allows an attacker to select the lowest-id activated user account by exploiting MySQL/MariaDB's VARCHAR equality behavior that ignores trailing spaces. Since the invite_hash is set to an empty string after activation, a URL-encoded space matches this empty string and selects the first activated user. The expiry check decrypts invite_sent_at with the target's password hash, but if decryption fails, the raw input is returned, allowing a numeric plaintext value to bypass the time-to-live check. Consequently, an unauthenticated attacker can overwrite the email and password of the selected account and log in as that user. This issue is resolved in FreeScout version 1.8.224.

An unauthenticated attacker can gain full control over the lowest-id activated FreeScout user account, which is typically a support agent or an administrator if one was invited. This leads to complete compromise of that account's confidentiality and integrity, allowing unauthorized access and potential disruption of service. The vulnerability has a CVSS 3.1 score of 9.4 (critical), reflecting its high impact and ease of exploitation without any privileges or user interaction.

A fix for this vulnerability is included in FreeScout version 1.8.224. Users should upgrade to version 1.8.224 or later to remediate this issue. No other official remediation or temporary fix is documented. Until upgrading, restrict access to the affected endpoint if possible.