FreeScout, a self‑hosted help desk platform, stores the CF‑Connecting‑IP header from failed login attempts in an activity log when the APP_CLOUDFLARE_IS_USED setting is enabled. The stored value is then inserted into administrator alert emails without escaping HTML. This flaw allows an attacker who can forge the CF‑Connecting‑IP header to inject arbitrary HTML or JavaScript, which will execute whenever an administrator opens the alert email, leading to a client‑side compromise or phishing. The weakness is an example of HTML injection (CWE‑79).

The vulnerability affects FreeScout deployments using the freescout-help-desk product, versions before 1.8.235. All installations that enable APP_CLOUDFLARE_IS_USED and rely on the default trust of the CF‑Connecting‑IP header are impacted.

The vulnerability has a CVSS score of 6.1, indicating moderate severity. EPSS information is not available and the issue is not listed in the CISA KEV catalog. The attack can be carried out by sending a request with a forged CF‑Connecting‑IP header to trigger a failed login, after which the attacker can trigger an administrator alert. Given that the flaw is a stored XSS triggered via email, exploitation requires that the targeted administrator opens the compromised email, which is a realistic scenario in many organizations.