# CVE-2026-34443: FreeScout SSRF via broken CIDR check in checkIpByMask

Source: https://junglewise.ai/threats/cve-2026-34443-freescout-ssrf-via-broken-cidr-check-in-checkipbymask  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34443 · Severity: medium · CVSS 5.3 · Published 2026-03-31

FreeScout, an open-source help desk and shared inbox platform, contains a security flaw that allows attackers to bypass internal network protections. By sending specially crafted emails with links to internal resources, an attacker can trick the server into accessing private data or services on the company's internal network that should be restricted. This could lead to the exposure of sensitive internal information or unauthorized access to other systems within the corporate environment.

Technologies: [FreeScout Help Desk FreeScout](https://junglewise.ai/threats/technologies/freescout). Vendors: [FreeScout Help Desk](https://junglewise.ai/threats/vendors/freescout-help-desk).

## Quick answers

**Is CVE-2026-34443 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34443 being exploited in the wild.

**How severe is CVE-2026-34443?** Medium severity, with a CVSS score of 5.3, published 31 March 2026.

**Which products and versions are affected?** FreeScout Help Desk FreeScout < 1.8.211.

**Is there a fix for CVE-2026-34443?** A patch was published on 2026-03-28: Version 1.8.211 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34443 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34443?** Check whether you run FreeScout Help Desk FreeScout at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in FreeScout's `checkIpByMask()` function within `app/Misc/Helper.php`. The function incorrectly checks if the input IP address contains a '/' character; since plain IP addresses do not contain this character, the function prematurely returns false, bypassing CIDR-based blocklists for private ranges such as 10.0.0.0/8 and 172.16.0.0/12. An unauthenticated remote attacker can exploit this by providing a remote attachment URL in an inbound email, causing the server to fetch resources from internal network addresses. The issue is fixed in version 1.8.211 by removing the erroneous check and adding missing private ranges to the restricted hosts list.

## Affected products

- freescout-help-desk FreeScout < 1.8.211

## Timeline

- 2026-03-28: patched: Version 1.8.211 released
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE published to NVD

## References

- [https://github.com/freescout-help-desk/freescout/commit/ca6d5bb572d3e8f52a0e654a8623a53cb0fdd580](https://github.com/freescout-help-desk/freescout/commit/ca6d5bb572d3e8f52a0e654a8623a53cb0fdd580)
- [https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211](https://github.com/freescout-help-desk/freescout/releases/tag/1.8.211)
- [https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-c9v3-4c59-x5q2](https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-c9v3-4c59-x5q2)

## Related threats

- [FreeScout missing authorization in internal note deletion](https://junglewise.ai/threats/cve-2026-48811-freescout-missing-authorization-in-internal-note-deletion)
- [FreeScout improper authorization in ThreadPolicy edit method](https://junglewise.ai/threats/cve-2026-48810-freescout-improper-authorization-in-threadpolicy-edit-method)
- [FreeScout agent impersonation via missing HMAC in notification replies](https://junglewise.ai/threats/cve-2026-47123-freescout-agent-impersonation-via-missing-hmac-in-notification)
- [FreeScout account enumeration in password reset endpoint](https://junglewise.ai/threats/cve-2026-45294-freescout-account-enumeration-in-password-reset-endpoint)
- [FreeScout host header injection in absolute URL generation](https://junglewise.ai/threats/cve-2026-34442-freescout-host-header-injection-in-absolute-url-generation)