Medium severity · published Oct 8, 2026
CVE-2026-107393
FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrator alert email without HTML escaping, allowing injected HTML to execute when an administrator opens the email. This issue is fixed in version 1.8.235.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
freescout · freescout-help-desk
< 1.8.235 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107393
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107393
x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9cm3-qvj2-8hg4
x_refsource_MISC
https://github.com/freescout-help-desk/freescout/commit/0f41f5cabb581de156ec8eb344ff6c0e6e0cc66a
x_refsource_MISC
https://github.com/freescout-help-desk/freescout/releases/tag/1.8.235
More from freescout
9.8
CVE-2026-40498
FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
9.8
CVE-2026-27637
FreeScout's Predictable Authentication Token Enables Account Takeover
9.8
CVE-2025-48481
FreeScout Has Business Logic Errors
9.8
CVE-2025-48471
FreeScout Vulnerable to Arbitrary File Upload
9.4
CVE-2026-53595
FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL