PT-2026-34010 · Freescout Help Desk · Freescout

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40566

NVD

CVSS v3.1

4.1

Medium

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a Server-Side Request Forgery (SSRF) vulnerability in the IMAP/SMTP connection test functionality of FreeScout's MailboxesController. Three AJAX actions fetch test (line 731), send test (line 682), and imap folders (line 773) in app/Http/Controllers/MailboxesController.php pass admin-configured in server/in port and out server/out port values directly to fsockopen() via Helper::checkPort() and to IMAP/SMTP client connections with zero SSRF protection. There is no IP validation, no hostname restriction, no blocklist of internal ranges, and no call to the project's own sanitizeRemoteUrl() or checkUrlIpAndHost() functions. The validation block in connectionIncomingSave() is entirely commented out. An authenticated admin can configure a mailbox's IMAP or SMTP server to point at any internal host and port, then trigger a connection test. The server opens raw TCP connections (via fsockopen()) and protocol-level connections (via IMAP client or SMTP transport) to the attacker-specified target. The response differentiates open from closed ports, enabling internal network port scanning. When the IMAP client connects to a non-IMAP service, the target's service banner or error response is captured in the IMAP debug log and returned in the AJAX response's log field, making this a semi-blind SSRF that enables service fingerprinting. In cloud environments, the metadata endpoint at 169[.]254[.]169[.]254 can be probed and partial response data may be leaked through protocol error messages. This is distinct from the sanitizeRemoteUrl() redirect bypass (freescout-3) -- different code path, different root cause, different protocol layer. Version 1.8.213 patches the vulnerability.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-40566

Affected Products

Freescout

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-40566 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213 · Note
• https://twitter.com/infoflowcloud/status/2046637725399269525 · Twitter Post
• https://twitter.com/CVEnew/status/2046636258697392585 · Twitter Post
• https://github.com/freescout-help-desk/freescout/commit/efe82e31b4a0d4c0b20025d09df0615e8139ff08 · Note
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-fg98-rgx6-8x4g · Note