FreeScout CVE-2026-40566

The vulnerability requires the attacker to hold an authenticated admin account in FreeScout with permissions to access the mailbox configuration interface and trigger connection tests. No unauthenticated exploitation is possible; CVSS PR:H correctly reflects this high-privilege requirement. The attacker must have network access to FreeScout's web interface (typically AV:N). No special product configuration is required; default FreeScout installations with the mailbox feature enabled are exploitable. Exploitation is limited to TCP port ranges and IP addresses reachable from the FreeScout server's network context. Organizations using network segmentation or outbound firewall rules that restrict the FreeScout server's egress to only authorized mail servers can prevent internal reconnaissance, though this requires explicit configuration beyond FreeScout's built-in protections.

CVSS 4.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) correctly reflects a network-accessible vulnerability with low attack complexity but high privilege barrier (PR:H requires admin role). The severity is mitigated by the admin-only authentication requirement; however, this does not eliminate risk in organizations where multiple administrators exist or admin accounts have broader permissions. EPSS data not provided. Exploitation requires no special conditions beyond admin access and is not reported as actively exploited (no KEV status in input). The vulnerability is technically straightforward (direct parameter to socket function), making exploitation trivial once admin credentials are obtained. Real-world risk depends on deployment context: in single-admin or restricted-access deployments, risk is lower; in larger organizations with shared admin responsibilities or compromised admin accounts, risk increases substantially. The semi-blind SSRF nature (service banners leaked via protocol errors) means this is not a complete information disclosure but enables reconnaissance of internal infrastructure. The scope change (S:C) indicates potential impact to systems beyond FreeScout itself (internal network targets). For environments without network segmentation, this could facilitate lateral movement reconnaissance.

An administrator (either legitimate with malicious intent or a compromised account) accesses the FreeScout mailbox configuration interface and sets the IMAP server address to an internal IP address such as 192.168.1.100 or a cloud metadata endpoint (169.254.169.254). The admin then triggers the connection test via the fetch_test or send_test AJAX actions. FreeScout opens a raw TCP connection to the specified target without validation, returning port-open/closed differentiation in the response. The attacker-controlled endpoint receives the unsolicited connection attempt, enabling port scanning. If the target is a non-IMAP service (e.g., SSH on port 22 or HTTP), the service banner is captured in IMAP debug output and returned in the AJAX response's log field, revealing service versions and enabling fingerprinting.