CVE-2026-34443
CIDR Bypass in FreeScout IP Check Allows Unauthorized Access
Publication date: 2026-03-31
Last updated on: 2026-04-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freescout | freescout | to 1.8.211 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
Because the vulnerability causes the application to fail to properly check IP addresses within certain private network ranges, unauthorized users within those ranges could potentially bypass IP-based access controls or restrictions.
This could lead to unauthorized access to the FreeScout help desk or shared inbox, potentially exposing sensitive information or allowing malicious actions within the system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade FreeScout to version 1.8.211 or later, where the issue has been patched.
Can you explain this vulnerability to me?
This vulnerability exists in FreeScout, a help desk and shared inbox application built with PHP's Laravel framework. Before version 1.8.211, the function checkIpByMask() in the file app/Misc/Helper.php incorrectly handled IP address checks. It only checked if the input IP contained a '/' character to determine if it was a CIDR range. Since plain IP addresses do not contain '/', the function always returned false without properly checking CIDR ranges. As a result, entire private IP ranges such as 10.0.0.0/8 and 172.16.0.0/12 were left unprotected.
This flaw was fixed in version 1.8.211.