CVE-2026-34443

Received Received - Intake

CIDR Bypass in FreeScout IP Check Allows Unauthorized Access

Publication date: 2026-03-31

Last updated on: 2026-04-13

Assigner: GitHub, Inc.

Description

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, checkIpByMask() in app/Misc/Helper.php checks whether the input IP contains a / character. Plain IP addresses never contain /, so the function always returns false without checking any CIDR ranges. The entire 10.0.0.0/8 and 172.16.0.0/12 private ranges are unprotected. This issue has been patched in version 1.8.211.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-31

Last Modified

2026-04-13

Generated

2026-07-06

AI Q&A

2026-04-01

EPSS Evaluated

2026-07-05

NVD

CVE-2026-34443

Affected Vendors & Products

Vendor	Product	Version / Range
freescout	freescout	to 1.8.211 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Impact Analysis

Because the vulnerability causes the application to fail to properly check IP addresses within certain private network ranges, unauthorized users within those ranges could potentially bypass IP-based access controls or restrictions.

This could lead to unauthorized access to the FreeScout help desk or shared inbox, potentially exposing sensitive information or allowing malicious actions within the system.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade FreeScout to version 1.8.211 or later, where the issue has been patched.

Executive Summary

This vulnerability exists in FreeScout, a help desk and shared inbox application built with PHP's Laravel framework. Before version 1.8.211, the function checkIpByMask() in the file app/Misc/Helper.php incorrectly handled IP address checks. It only checked if the input IP contained a '/' character to determine if it was a CIDR range. Since plain IP addresses do not contain '/', the function always returned false without properly checking CIDR ranges. As a result, entire private IP ranges such as 10.0.0.0/8 and 172.16.0.0/12 were left unprotected.

This flaw was fixed in version 1.8.211.

Hi! I’m here to help you understand CVE-2026-34443. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70