CVE-2026-107393

MEDIUM 6.1

FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrator alert email without HTML escaping, allowing injected HTML to execute when an administrator opens the email. This issue is fixed in version 1.8.235.

CWE	CWE-79 CWE-116
Vendor	freescout-help-desk
Product	freescout
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for freescout-help-desk freescout

Be the first to know when new medium vulnerabilities affecting freescout-help-desk freescout are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

freescout-help-desk / freescout

< 1.8.235

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9cm3-qvj2-8hg4 github.com: https://github.com/freescout-help-desk/freescout/commit/0f41f5cabb581de156ec8eb344ff6c0e6e0cc66a github.com: https://github.com/freescout-help-desk/freescout/releases/tag/1.8.235