CVE-2026-107393 in FreeScout
Summary
by MITRE • 10/08/2026
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrator alert email without HTML escaping, allowing injected HTML to execute when an administrator opens the email. This issue is fixed in version 1.8.235.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified within FreeScout versions prior to 1.8.235 represents a critical intersection of server-side request forgery principles and cross-site scripting, stemming from improper validation of HTTP headers when the application is configured behind Cloudflare. In environments where the APP_CLOUDFLARE_IS_USED configuration flag is enabled, the software relies on the CF-Connecting-IP header to identify the originating IP address of incoming requests for logging purposes. However, this implementation fails to validate whether the provided IP address actually corresponds to a legitimate connection from Cloudflare's infrastructure or if it has been arbitrarily set by an attacker in a crafted HTTP request. This lack of validation allows malicious actors to spoof their apparent source IP address, which is then stored directly into the application’s activity logs without sanitization.
The operational impact escalates significantly when these unvalidated log entries are processed by the LogsMonitor component for administrative alerting. The system generates email notifications containing details of failed login attempts or other logged events, inserting the potentially spoofed CF-Connecting-IP value directly into the body of these emails. Crucially, this insertion occurs without HTML escaping, meaning that any special characters within the IP address field are interpreted as executable code by the recipient's email client rather than being displayed as plain text. This architectural flaw transforms a simple logging error into a persistent cross-site scripting vulnerability targeting system administrators who receive and view these alert emails.
An attacker can exploit this weakness by crafting HTTP requests with malicious payloads embedded in the CF-Connecting-IP header, such as JavaScript code designed to steal session cookies, perform actions on behalf of the administrator, or redirect them to phishing sites. When an administrator opens a notification email containing this injected content, their browser executes the script within the context of the FreeScout application domain if any cross-domain trust exists, or simply exposes sensitive information like administrative credentials and internal network topology details through data exfiltration techniques. This vector is particularly dangerous because it bypasses traditional input validation mechanisms that focus on form fields rather than HTTP headers, leveraging the trusted relationship between the web server and its reverse proxy configuration to inject malicious code into a high-privilege user interface element.
From a classification perspective, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting, specifically in the context of stored XSS where the payload is saved on the server and retrieved later by users. Additionally, it relates to CWE-20 regarding improper input validation, particularly concerning HTTP headers that are assumed to be trustworthy due to their origin from a reverse proxy like Cloudflare but are not rigorously verified against expected ranges or formats. In terms of offensive security frameworks, this attack vector maps to the ATT&CK technique T1189 Drive-by Client Side Code Execution, as it involves tricking an administrator into executing code through a seemingly legitimate administrative communication channel, and potentially T1078 Valid Accounts if used in conjunction with credential theft to maintain persistent access.
To mitigate this vulnerability, organizations running FreeScout must upgrade immediately to version 1.8.235 or later, where the developers have implemented proper validation for the CF-Connecting-IP header and applied HTML escaping when rendering log data in email alerts. For environments that cannot patch instantly due to operational constraints, a temporary mitigation involves configuring the reverse proxy or web server to strip or override the CF-Connecting-IP header with the actual client IP address before it reaches the FreeScout application logic. Furthermore, administrators should ensure that their email clients are configured to render plain text only for alert notifications where possible, reducing the attack surface for HTML-based injection attacks while maintaining visibility into system events through alternative logging mechanisms such as syslog or SIEM integration that do not rely on executable content in emails.