CVE-2026-34443
Received Received - Intake
CIDR Bypass in FreeScout IP Check Allows Unauthorized Access

Publication date: 2026-03-31

Last updated on: 2026-04-13

Assigner: GitHub, Inc.

Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, checkIpByMask() in app/Misc/Helper.php checks whether the input IP contains a / character. Plain IP addresses never contain /, so the function always returns false without checking any CIDR ranges. The entire 10.0.0.0/8 and 172.16.0.0/12 private ranges are unprotected. This issue has been patched in version 1.8.211.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-31
Last Modified
2026-04-13
Generated
2026-06-16
AI Q&A
2026-04-01
EPSS Evaluated
2026-06-15
NVD
CVE-2026-34443
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
freescout freescout to 1.8.211 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in FreeScout, a help desk and shared inbox application built with PHP's Laravel framework. Before version 1.8.211, the function checkIpByMask() in the file app/Misc/Helper.php incorrectly handled IP address checks. It only checked if the input IP contained a '/' character to determine if it was a CIDR range. Since plain IP addresses do not contain '/', the function always returned false without properly checking CIDR ranges. As a result, entire private IP ranges such as 10.0.0.0/8 and 172.16.0.0/12 were left unprotected.

This flaw was fixed in version 1.8.211.

Impact Analysis

Because the vulnerability causes the application to fail to properly check IP addresses within certain private network ranges, unauthorized users within those ranges could potentially bypass IP-based access controls or restrictions.

This could lead to unauthorized access to the FreeScout help desk or shared inbox, potentially exposing sensitive information or allowing malicious actions within the system.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade FreeScout to version 1.8.211 or later, where the issue has been patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34443. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart