Freescout CVE-2026-34443

Despite the absence of a CVSS score and vector in the input data, the vulnerability carries significant real-world risk. The root cause is a trivial logic error in a security-critical function, making it highly likely to be exploitable by any attacker who can control URLs processed by the application. The attack vector is network-based and requires no authentication (typical for SSRF flaws affecting URL fetching or webhook handlers). The impact is direct: SSRF enables reconnaissance and access to internal services on private networks, potentially leading to credential theft, configuration disclosure, or pivot attacks against backend systems. The fact that no CVSS or EPSS data is available suggests this CVE may be relatively recent; however, the simplicity of the logic error and the clarity of the bypass (plain IPs vs. CIDR notation) indicate high exploitability. No KEV or public POC is referenced in the input, but the vulnerability is patched upstream, suggesting vendor confidence in the fix. Organizations running FreeScout on networks with internal services reachable from the application should prioritize this patch.

An attacker discovers a FreeScout instance with an email integration feature that fetches content from user-supplied URLs (e.g., for webhook forwarding or email template rendering). By submitting a URL pointing to a private IP address such as http://10.5.2.1:8080/admin or http://172.16.0.50/internal-api, the attacker bypasses the defective checkIpByMask() validation and causes the application to perform an outbound request to the internal service. The attacker retrieves sensitive information from internal APIs, dashboards, or configuration endpoints that are normally isolated from the internet, escalating to information disclosure or further compromise of backend infrastructure. No public POC is referenced, but the trivial nature of the bypass (simply omitting CIDR notation) makes exploitation straightforward once the vulnerability is known.