Executive brief
FreeScout, an open-source help desk and shared inbox platform, contains a security flaw that allows attackers to bypass internal network protections. By sending specially crafted emails with links to internal resources, an attacker can trick the server into accessing private data or services on the company's internal network that should be restricted. This could lead to the exposure of sensitive internal information or unauthorized access to other systems within the corporate environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in FreeScout's `checkIpByMask()` function within `app/Misc/Helper.php`. The function incorrectly checks if the input IP address contains a '/' character; since plain IP addresses do not contain this character, the function prematurely returns false, bypassing CIDR-based blocklists for private ranges such as 10.0.0.0/8 and 172.16.0.0/12. An unauthenticated remote attacker can exploit this by providing a remote attachment URL in an inbound email, causing the server to fetch resources from internal network addresses. The issue is fixed in version 1.8.211 by removing the erroneous check and adding missing private ranges to the restricted hosts list.
Affected products
- freescout-help-desk FreeScout < 1.8.211
Timeline
- 2026-03-28: patched: Version 1.8.211 released
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE published to NVD