CVE-2026-41904: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in freescout-help-desk freescout
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with updateAutoReply permission can store an XSS payload in the mailbox auto-reply message. The payload is rendered unescaped in the auto-reply email sent to every customer who contacts the mailbox. Email clients do not enforce CSP, so the payload executes in the customer's webmail / mail-client context. This issue has been patched in version 1.8.217.
AI Analysis
Technical Summary
FreeScout, a PHP Laravel-based help desk and shared inbox application, contained an XSS vulnerability (CWE-79) in versions before 1.8.217. Specifically, users authorized to update auto-reply messages could embed malicious scripts that are not properly neutralized. These scripts are included unescaped in auto-reply emails sent to customers, allowing execution in the customer's mail client environment. This vulnerability was addressed and patched in version 1.8.217.
Potential Impact
Successful exploitation allows an attacker with updateAutoReply permission to execute arbitrary scripts in the context of the customer's email client when they receive an auto-reply message. This could lead to information disclosure or other impacts related to script execution in the victim's mail client. The CVSS score of 7.6 reflects high severity with high confidentiality impact, limited integrity impact, and no availability impact.
Mitigation Recommendations
This vulnerability is patched in FreeScout version 1.8.217. Users should upgrade to version 1.8.217 or later to remediate this issue. No additional mitigation guidance is provided or required beyond applying the official fix.
CVE-2026-41904: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in freescout-help-desk freescout
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with updateAutoReply permission can store an XSS payload in the mailbox auto-reply message. The payload is rendered unescaped in the auto-reply email sent to every customer who contacts the mailbox. Email clients do not enforce CSP, so the payload executes in the customer's webmail / mail-client context. This issue has been patched in version 1.8.217.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FreeScout, a PHP Laravel-based help desk and shared inbox application, contained an XSS vulnerability (CWE-79) in versions before 1.8.217. Specifically, users authorized to update auto-reply messages could embed malicious scripts that are not properly neutralized. These scripts are included unescaped in auto-reply emails sent to customers, allowing execution in the customer's mail client environment. This vulnerability was addressed and patched in version 1.8.217.
Potential Impact
Successful exploitation allows an attacker with updateAutoReply permission to execute arbitrary scripts in the context of the customer's email client when they receive an auto-reply message. This could lead to information disclosure or other impacts related to script execution in the victim's mail client. The CVSS score of 7.6 reflects high severity with high confidentiality impact, limited integrity impact, and no availability impact.
Mitigation Recommendations
This vulnerability is patched in FreeScout version 1.8.217. Users should upgrade to version 1.8.217 or later to remediate this issue. No additional mitigation guidance is provided or required beyond applying the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-22T15:11:54.672Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fcdf2dcbff5d86101f12e0
Added to database: 5/7/2026, 6:51:25 PM
Last enriched: 5/7/2026, 7:07:35 PM
Last updated: 5/8/2026, 10:35:47 AM
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.