Freescout EUVD-2026-17673

CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible, low-complexity exploitation requiring no privileges but mandating user interaction. EPSS score not provided, limiting exploitation probability assessment. No public exploit code or CISA KEV status reported, suggesting this is a confirmed but not yet weaponized vulnerability. The requirement for UI interaction (user clicking a malicious link) significantly reduces real-world impact compared to a CVSS 5.4 with UI:N. Threat model depends on help desk context: attacks targeting support staff or end-users via phishing emails containing FreeScout-generated links are plausible. The vulnerability affects all versions prior to 1.8.211, making it a patch-worthy priority but not a critical 0-day. Organizations running exposed FreeScout instances should prioritize patching, particularly if user-facing.

An attacker sends a help desk support request containing a crafted FreeScout URL with a malicious Host header (e.g., 'Host: evil.com'), or crafts a link to /system/status with Host manipulation. When a support staff member or customer clicks a generated password reset link or accesses the system status page, the application constructs absolute URLs using the attacker-controlled Host header value, redirecting the user to attacker.com. Alternatively, if FreeScout generates email notification links based on the Host header, the attacker can include a malicious Host in the initial request, causing the application to send emails with links pointing to attacker infrastructure. No public exploit code has been identified, but the attack requires only HTTP request crafting and user-interaction execution.