CVE-2026-23753 is a stored cross-site scripting vulnerability in GFI HelpDesk prior to version 4.99.9. The issue arises because the charset POST parameter is passed directly to the SWIFT_Language::Create() function without HTML sanitization and is later rendered unsanitized by View_Language.RenderGrid(). This allows an authenticated administrator to inject arbitrary JavaScript code, which executes in the browsers of other administrators viewing the Languages page. The vulnerability requires administrator privileges to exploit and does not involve user interaction beyond viewing the affected page.

An attacker with authenticated administrator access can inject malicious JavaScript code that executes in the browsers of other administrators viewing the Languages page. This could lead to session hijacking, unauthorized actions performed with administrator privileges, or other malicious activities within the context of the HelpDesk application. The vulnerability does not affect unauthenticated users and requires administrator-level access to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and consider monitoring for unusual administrator activity. Avoid viewing the Languages page in untrusted environments. Do not rely on generic mitigations; wait for vendor-provided patches or official workarounds.