FreeScout’s MailboxesController allows an authenticated administrator to execute a Server‑Side Request Forgery by specifying arbitrary internal IMAP or SMTP server addresses for connection testing. The back‑end code directly passes the admin‑configured server hostname and port to low‑level socket or protocol clients without any IP validation, hostname restriction or blocklist. This results in the FreeScout service opening raw TCP connections and protocol‑level client connections to an attacker‑chosen target, revealing whether the port is open, and when connecting to non‑IMAP/SMTP services, returning the target’s service banner or error message in the AJAX response’s log field. In cloud deployments, this also permits probing the instance metadata endpoint, potentially leaking partial response data through protocol error messages.

Versions of the freescout-help-desk freescout product older than 1.8.213 are affected. Any instance of the application using these versions with an administrative account capable of configuring mailboxes is vulnerable.

The vulnerability carries a CVSS score of 4.1, indicating moderate severity; the EPSS score is not available and the issue is not listed in the CISA KEV catalog. Nevertheless, the flaw requires authenticated administrative access, but it permits the attacker to probe internal network services, gain service fingerprints, and in some cases retrieve sensitive metadata. The attack path is straightforward: an admin configures mailbox settings to point to a chosen internal host and port, then triggers a connection test. The lack of outbound connection restrictions and the server’s ability to open arbitrary sockets make exploitation highly feasible in environments where the application is reachable by authorised administrators.