CVE-2026-85743

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, and ModulesController.php do not consistently enforce a sink-level restricted-host policy. An authenticated administrator, or another authenticated user permitted to change mailbox connection settings or trigger module update or installation paths, can supply attacker-controlled URLs or hosts. The independent download and port-test sinks can reach encoded or otherwise uncovered loopback and internal addresses. The redirect-validation bypass additionally requires a configured whitelist that permits the original and final hosts while a restricted internal host appears only as an intermediate redirect hop. No unauthenticated SSRF path is established. The server can consequently contact loopback and internal services, provide a blind internal port oracle, and retrieve internal HTTP responses into application-controlled download sinks. This issue is fixed in version 1.8.230.

• CWE-918

• https://github.com/freescout-help-desk/freescout/commit/09799fd4bcf731704bc2099a87bca0cf18d20acb
• https://github.com/freescout-help-desk/freescout/commit/a4c587cf1fff87eae7d3e4f297fa4cc81ba28704
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85736Chartbrew is an open-source web application that can connect…8.1
• CVE-2026-85737Velociraptor is a tool for collecting host-based state infor…6.5
• CVE-2026-85738TREK is a collaborative travel planner. Prior to 3.4.0, the …6.3
• CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to …8.3
• CVE-2026-85740LightRAG provides simple and fast retrieval-augmented genera…7.1
• CVE-2026-85742FreeScout is a self-hosted help desk and shared mailbox. Pri…7.5
• CVE-2026-85744FreeScout is a self-hosted help desk and shared mailbox. Pri…5.4
• CVE-2026-85745MariaDB server is a community developed fork of MySQL server…4.3
• CVE-2026-85746MariaDB server is a community developed fork of MySQL server…9.9
• CVE-2026-85747Distribution is a toolkit to pack, ship, store, and deliver …6.8
• CVE-2026-85748MariaDB server is a community developed fork of MySQL server…9.9
• CVE-2026-85749MailWatch for MailScanner is a web-based front-end to MailSc…8.1