Is CVE-2026-107393 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107393 being exploited in the wild.

How severe is CVE-2026-107393?

Medium severity, with a CVSS score of 6.1, published 8 October 2026.

Is there a fix for CVE-2026-107393?

Yes: fixed in 1.8.235. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107393 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107393?

Check whether you run FreeScout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107393: FreeScout stored XSS in admin alert email via spoofed CF-Connecting-IP

CVE-2026-107393 · Severity: medium · CVSS 6.1 · Published 2026-10-08

FreeScout is a self-hosted help desk platform that manages customer support tickets and shared inboxes. When Cloudflare integration is enabled, the application incorrectly trusts an unvalidated HTTP header and stores attacker-controlled data in activity logs. Administrators who open alert emails containing this data may execute malicious HTML code in their email client, potentially leading to account compromise or credential theft.

Technologies: FreeScout. Vendors: FreeScout.

Quick answers

Is CVE-2026-107393 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107393 being exploited in the wild.
How severe is CVE-2026-107393?: Medium severity, with a CVSS score of 6.1, published 8 October 2026.
Which products and versions are affected?: FreeScout prior to 1.8.235.
Is there a fix for CVE-2026-107393?: Yes: fixed in 1.8.235. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107393 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107393?: Check whether you run FreeScout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.8.235

Technical details

When APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts the unvalidated CF-Connecting-IP HTTP header during failed login attempts and stores the unsanitized value in the activity log. The LogsMonitor command outputs this value into administrator alert emails without HTML escaping, enabling stored XSS. An attacker can inject arbitrary HTML/JavaScript via a crafted CF-Connecting-IP header during login attempts to compromise administrators who read alert emails.

Affected products

FreeScout FreeScout prior to 1.8.235

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.