Stored Cross-Site Scripting Vulnerability in FreeScout Help Desk

CVE-2026-40568

What is CVE-2026-40568?

FreeScout, a self-hosted help desk platform, is susceptible to a stored cross-site scripting (XSS) vulnerability in its mailbox signature feature. This issue occurs because the sanitization function allows certain HTML elements, including those with event handler attributes, to be saved unchanged. Authenticated users with the appropriate permission can inject harmful scripts into the signature. The attack triggers automatically when mailboxes are accessed, enabling malicious actions such as session hijacking and phishing, which can compromise user data and facilitate email exfiltration. The vulnerability requires immediate attention, with version 1.8.213 offering a critical fix.

References