CVE-2026-40567 is an improper encoding or escaping of output vulnerability (CWE-116) in FreeScout help desk software versions before 1.8.213. An attacker can send an email with a maliciously crafted From display name that FreeScout stores without sanitization. When FreeScout generates outgoing reply emails, it inserts this unsanitized name into the email signature using the `{%customer.fullName%}` variable without escaping, allowing arbitrary HTML injection. This can be exploited to embed phishing links, tracking pixels, or spoofed content in emails sent from the organization's address. The vulnerability is resolved in FreeScout version 1.8.213.

The vulnerability allows unauthenticated attackers to inject arbitrary HTML content into legitimate outgoing emails from FreeScout, potentially enabling phishing attacks, user tracking, or spoofed messages. There is no direct confidentiality or availability impact reported. The CVSS 3.1 base score is 5.8 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and impact limited to integrity (HTML injection). No known exploits in the wild have been reported.

Upgrade FreeScout to version 1.8.213 or later, where this vulnerability is fixed. Since this is a self-hosted product, administrators must apply the update manually. Patch status is not explicitly stated in the vendor advisory, but the description confirms version 1.8.213 resolves the issue. Until patched, consider sanitizing or validating incoming email display names as a temporary measure.