Medium severity6.1NVD Advisory· Published Oct 8, 2026· Updated Oct 8, 2026

CVE-2026-107393

Description

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrator alert email without HTML escaping, allowing injected HTML to execute when an administrator opens the email. This issue is fixed in version 1.8.235.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Freescout/Freescoutllm-fuzzy
Range: <1.8.235

Patches

Vulnerability mechanics

References

github.com/freescout-help-desk/freescout/commit/0f41f5cabb581de156ec8eb344ff6c0e6e0cc66anvd
github.com/freescout-help-desk/freescout/releases/tag/1.8.235nvd
github.com/freescout-help-desk/freescout/security/advisories/GHSA-9cm3-qvj2-8hg4nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000