CVE-2026-107393 freescout-help-desk CVE debrief

Who should care

Defenders responsible for FreeScout instances, especially those using versions prior to 1.8.235, should assess their exposure and take necessary actions to protect against this vulnerability.

Why it matters

Defenders should care about CVE-2026-107393 because it allows for stored HTML injection in administrator alert emails via spoofed CF-Connecting-IP headers in FreeScout versions prior to 1.8.235. This could lead to potential security risks if exploited. Defenders responsible for FreeScout instances should verify their version, assess exposure, and update to 1.8.235 or later if necessary.

• Potential execution of injected HTML in administrator alert emails.
• Possible spoofing of CF-Connecting-IP header values.
• Need for verification of FreeScout version and exposure.
• Potential for HTML injection attacks via LogsMonitor

Technical summary

The vulnerability exists in FreeScout versions prior to 1.8.235. When APP_CLOUDFLARE_IS_USED is enabled, FreeScout stores an unvalidated CF-Connecting-IP header value in the activity log during failed login attempts. LogsMonitor inserts this value into administrator alert emails without HTML escaping, allowing injected HTML to execute when an administrator opens the email. This issue allows for stored HTML injection in administrator alert emails via spoofed CF-Connecting-IP headers. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they are using FreeScout versions prior to 1.8.235.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they are using FreeScout versions prior to 1.8.235.

Recommended defensive actions

• Verify if the FreeScout instance is using a version prior to 1.8.235 and update to 1.8.235 or later if necessary.
• Assess the exposure of FreeScout instances to untrusted networks or users who could potentially spoof the CF-Connecting-IP header.
• Review administrator alert emails for any suspicious content that could indicate exploitation.
• Consider implementing additional security measures to protect against similar vulnerabilities in the future.
• Confirm whether affected FreeScout deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its existence in FreeScout versions prior to 1.8.235 and the fix in version 1.8.235. However, there is limited information about potential exploitation or specific impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.