What is the CVSS score of CVE-2026-41905?

CVE-2026-41905 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of FreeScout are affected by CVE-2026-41905?

FreeScout versions before 1.8.217 contain a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users to bypass security controls and access internal network resources and…. A patch is available.

How to fix or mitigate CVE-2026-41905?

Within 24 hours: Inventory all FreeScout instances and document current versions; verify which instances are exposed to untrusted authenticated users. Within 7 days: Apply vendor-released patch to FreeScout version 1.8.217 or later on all affected instances; prioritize cloud-hosted deployments. Within 30 days: Conduct access logs review for suspicious HTTP redirect patterns and internal resource access attempts; validate that all instances are running patched version.

FreeScout CVE-2026-41905

EUVD-2026-28408 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-07 GitHub_M

SSRF PHP

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 07, 2026 - 20:02 EUVD

Source Code Evidence Fetched

May 07, 2026 - 19:46 vuln.today

Analysis Generated

May 07, 2026 - 19:46 vuln.today

CVE Published

May 07, 2026 - 18:08 nvd

HIGH 7.7

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::sanitizeRemoteUrl() in app/Misc/Helper.php follows HTTP redirects via curlGetLastRedirectedUrl() but then re-validates the original URL instead of the final redirect destination. An attacker who can supply any URL that passes the initial host check can redirect FreeScout to internal HTTP services (cloud metadata, internal APIs, RFC1918 ranges) that would normally be blocked. This issue has been patched in version 1.8.217.

AnalysisAI

Server-Side Request Forgery (SSRF) in FreeScout allows authenticated users to access internal network resources and cloud metadata services via HTTP redirect bypass. The vulnerability in Helper::sanitizeRemoteUrl() re-validates the original URL instead of the final redirect destination, enabling attackers to bypass allowlist controls and reach RFC1918 private networks, cloud metadata APIs (169.254.169.254), and internal HTTP services. FreeScout versions prior to 1.8.217 are affected. Vendor-released patch version 1.8.217 is available. No public exploit code or CISA KEV listing identified at time of analysis, but SSRF vulnerabilities are frequently exploited in cloud environments for credential theft and lateral movement.

Technical ContextAI

FreeScout is a PHP-based help desk application built on the Laravel framework. The vulnerability resides in the Helper::sanitizeRemoteUrl() function in app/Misc/Helper.php, which implements URL validation for remote resources. The function uses curlGetLastRedirectedUrl() to follow HTTP redirects but commits a critical logic error by re-validating the original user-supplied URL rather than the final destination after redirects. This creates a classic SSRF validation bypass where an attacker supplies a URL pointing to an attacker-controlled redirect service that initially passes the allowlist check (e.g., attacker.com) but then 302-redirects to a blocked destination (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/ or http://192.168.1.1/admin). The vulnerability is classified as CWE-918 (Server-Side Request Forgery), a weakness where server-side code makes requests to user-controlled URLs without proper validation, enabling attackers to abuse the server's network position and trust relationships.

RemediationAI

Upgrade to FreeScout version 1.8.217 or later, which contains the validated fix for the redirect validation bypass in Helper::sanitizeRemoteUrl(). The patch is confirmed in release notes at https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217 under security fix GHSA-22wf-848c-c856. If immediate patching is not feasible, implement compensating controls: (1) Restrict FreeScout server's outbound network access using firewall rules to block RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local addresses (169.254.0.0/16) - note this may break legitimate integrations with internal services; (2) On cloud platforms, use instance metadata service protections such as AWS IMDSv2 (requiring PUT requests with tokens) to prevent simple HTTP GET-based metadata access, though this does not prevent SSRF to other internal services; (3) Review and restrict user account provisioning to trusted personnel only, reducing the pool of potential authenticated attackers; (4) Monitor outbound HTTP requests from FreeScout servers for suspicious destinations, particularly metadata IPs and internal ranges. All compensating controls are partial mitigations - upgrading to 1.8.217 is the only complete remediation.