Vulnerability in laravel (CVE-2026-41902)
Summary
vulnerability in laravel (CVE-2026-41902). Confidential information can be exposed externally. Exploitable via Referer header.
Original description
The description as published by the source.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-character random invite_hash to set a new user's password. The endpoint performs no expiration check — the hash remains valid indefinitely until consumed. Combined with realistic hash-leakage scenarios (forwarded invite emails, HTTP referrer to external CDNs on the setup page, server-side log exposure, abandoned invite emails in shared inboxes), this enables unauthenticated permanent account takeover months or years after invite issuance. If the leaked invite was sent to an admin, the takeover yields admin access. This issue has been patched in version 1.8.217.
Source: NIST National Vulnerability Database NVD
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
FreeScout, a system built on the Laravel framework, had a flaw where user invite links never expired, allowing for potential account takeovers if the link leaked, especially for admin accounts. This issue is resolved in the latest version. If your company uses FreeScout, it is recommended to update immediately to protect against unauthorized access.
The /user-setup/{hash} endpoint in FreeScout allowed setting a new user's password using a 60-character invite hash without any expiration check up to version 1.8.216. This flaw permitted unauthorized account takeover if the link leaked. It was fixed in version 1.8.217 by enforcing expiration on invite links. To counteract exploit vectors, setting up expiration for invite links is advisable. Detection can be done by monitoring access to the /login endpoint for unusual activities.
The /user-setup/{hash} endpoint allowed use of a 60-character invite hash without expiration.
FreeScout up to version 1.8.216, patched in 1.8.217.
Critical risk of unauthorized account takeover if invite links are leaked.
Upgrade to FreeScout version 1.8.217, which includes expiration checks for invite hashes.
Set up an expiration for invite links if upgrading is not immediately possible.
Monitor /login endpoint for unusual login attempts or access.
Related past incidents Similar incidents extracted from past CVEs
A similar issue in another CMS where API keys did not expire, leading to account takeovers.
A Laravel application had a similar invite link expiration vulnerability.
Another case where leaked invite URLs led to unauthorized access in enterprise systems.
If this happens at your company Expected impact per business scenario
A leaked admin invitation could give unauthorized access to internal systems.
Customer data exposure if shared inboxes are accessed by unauthorized persons.
Potential loss of control over user accounts if employee invitation links are forwarded externally.
Immediately update FreeScout to the latest version and ensure all user invitation links are secure with proper expiration.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'laravel' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
laravelを grep し、稼働しているサービス・バージョンを把握する。 -
2Match against affected range verify
Confirm if version satisfies `<1.8.217`Step 1 で見つかったバージョンが影響範囲
<1.8.217に該当するか照合。本番で稼働中ならインシデント扱い。 -
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。