CVE-2026-40497: CSRF in FreeScout Help Desk

The vulnerability lies in FreeScout's inadequate sanitization of <style> tags within the mailbox signature field. While other potentially dangerous tags like <script>, <form>, <iframe>, and <object> are stripped, <style> tags are not. These injected <style> tags are then rendered unescaped in conversation views. Given that FreeScout's Content Security Policy (CSP) allows style-src * 'self' 'unsafe-inline', injected inline styles execute freely. An attacker with access to modify mailbox settings – either as an administrator or an agent with mailbox permissions – can exploit this to inject malicious CSS. This could be used to steal user cookies, redirect users to phishing sites, or deface the FreeScout interface. The blast radius is limited to users accessing conversations within the affected mailbox.

1. Reserved2026-04-13
2. Published2026-04-21
3. EPSS updated2026-04-28

The primary mitigation is to upgrade FreeScout to version 1.8.213 or later, which includes the necessary fix to properly sanitize <style> tags. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block POST requests to /mailbox/settings/{id} containing suspicious <style> tags. Alternatively, restrict access to mailbox settings to only trusted administrators and agents. Monitor FreeScout logs for unusual activity, particularly POST requests to the settings endpoint. While a direct detection signature is difficult, look for unusual CSS patterns within mailbox signatures.