CVE-2026-34443
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
FreeScout, a help desk system built with Laravel, has a bug in the checkIpByMask() function that checks if the input IP contains a '/' character. Plain IP addresses never contain '/', so the function always returns false without checking CIDR ranges. Private ranges 10.0.0.0/8 and 172.16.0.0/12 remain unprotected. Affects versions prior to 1.8.211.
Risk Assessment
Attackers from internal networks can bypass IP protection, potentially leading to unauthorized access to administrative functions.
Recommendation
Update FreeScout to version 1.8.211 or later.
Original NVD description (English source)
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, checkIpByMask() in app/Misc/Helper.php checks whether the input IP contains a / character. Plain IP addresses never contain /, so the function always returns false without checking any CIDR ranges. The entire 10.0.0.0/8 and 172.16.0.0/12 private ranges are unprotected. This issue has been patched in version 1.8.211.