What is CVE-2026-53595?

CVE-2026-53595 is a critical-severity vulnerability in Freescout-help-desk Freescout, classified under Improper Handling of Case Sensitivity. CVSS score: 9.4/10. Published 2026-07-20.

How severe is CVE-2026-53595?

Critical severity. CVSS v3 base score is 9.4 out of 10.

Auth bypass in Freescout-help-desk Freescout

CVE-2026-53595

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely…

CVSS v3 metric

CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.

Affected products

Freescout-help-desk Freescout — versions < 1.8.224

Weakness classification (CWE)

CWE-178 — Improper Handling of Case Sensitivity
CWE-287 — Improper Authentication
CWE-640 — Weak Password Recovery Mechanism for Forgotten Password

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-53595?: CVE-2026-53595 is a critical-severity vulnerability in Freescout-help-desk Freescout, classified under Improper Handling of Case Sensitivity. CVSS score: 9.4/10. Published 2026-07-20.
How severe is CVE-2026-53595?: Critical severity. CVSS v3 base score is 9.4 out of 10.