Remote Code Execution Weakness in FreeScout Help Desk by FreeScout

CVE-2026-85743

What is CVE-2026-85743?

FreeScout, a self-hosted help desk solution, has a vulnerability where certain functions do not properly enforce access control on outbound network connections. Prior to version 1.8.230, an authenticated user with the necessary privileges could exploit this flaw by providing malicious URLs. This could lead to unauthorized access to internal systems and services, effectively allowing attackers to retrieve sensitive information from internal networks. The issue arises from the improper handling of redirection and whitelisting, allowing internal addresses to be contacted through manipulated requests. Affected users are encouraged to upgrade to version 1.8.230 to mitigate this risk.

References