FreeScout accepts the Host header from incoming HTTP requests without validation and incorporates it into generated absolute URLs. An attacker can alter the Host header to an arbitrary domain, causing the application to build links and load assets that point to malicious servers. This results in open redirect behavior that can redirect users to phishing or malware sites and enables the loading of external resources, potentially exfiltrating data or executing code in the user’s browser. The weakness combines Host Header Injection (CWE‑20) with Open Redirect (CWE‑601) and unauthorized resource access (CWE‑829).

The vulnerability exists in the FreeScout help desk product for all releases prior to version 1.8.211. Users deploying freescout-help-desk:freescout must verify that their installation is newer than this release to ensure the issue is addressed.

The CVSS base score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. An attacker needs only to craft a HTTP request with a modified Host header, a relatively simple requirement that can be automated. Because Host header manipulation can be performed from any external source, the risk to systems that are exposed to the internet is real, but the probability of a large-scale attack remains low given the expert knowledge required to exploit the flaw.