FreeScout EUVD-2026-95211

Exploitation requires the FreeScout APP_CLOUDFLARE_IS_USED setting to be enabled (a non-default, Cloudflare-fronted deployment mode) so that the CF-Connecting-IP header is trusted; the attacker triggers logging via failed login attempts, no authentication needed. Firing the payload additionally requires an administrator to open the LogsMonitor alert email in a client that renders HTML (UI:R) - the attack is blind, with no attacker feedback. Limiting factors: both the Cloudflare configuration and the LogsMonitor email-alert feature must be active, and the admin must open the mail; instances not behind Cloudflare or with CF integration disabled are not exploitable.

This is a stored/blind cross-site scripting issue (CWE-79) with a moderate CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The network vector and PR:N correctly reflect that the injection point - the CF-Connecting-IP header during a failed login - is reachable by an unauthenticated remote attacker, but UI:R is the dominant limiting factor: the payload only fires when an administrator opens the LogsMonitor alert email in an HTML-rendering client. Two further constraints materially lower real-world risk and are not captured by the headline score: exploitation requires the non-default APP_CLOUDFLARE_IS_USED deployment mode to be enabled, and the attacker gets no feedback (blind delivery via email), so this favors targeted abuse of a known FreeScout+Cloudflare install over opportunistic mass exploitation. No EPSS score, KEV listing, or SSVC decision data was supplied in the input, so automatability and exploitation-maturity signals cannot be cross-referenced - the only corroborating artifact is the vendor fix commit, which is a patch, not an exploit. Net: a legitimately valid but conditional issue that should be patched, not an emergency; treat it as medium priority rather than a high-CVSS critical. Note the AC:L in the supplied vector arguably understates the Cloudflare-mode precondition - see assessed vector below.

An attacker who knows a FreeScout instance sits behind Cloudflare submits failed login attempts with a forged CF-Connecting-IP header containing HTML/JavaScript; FreeScout trusts and logs the spoofed value. When the scheduled LogsMonitor job emails the activity summary to an administrator, the unescaped payload is embedded in the message and executes the moment the admin opens it in an HTML-capable mail client. No public exploit code was identified in the input - only the vendor patch commit is available.