CVE-2026-40568: XSS in FreeScout Help Desk Software

The XSS vulnerability in FreeScout arises from insufficient sanitization of HTML tags within the mailbox signature feature. The Helper::stripDangerousTags() function employs a limited blocklist, failing to remove event handler attributes and allowing the injection of potentially harmful HTML elements like <img>, <svg>, and <details>. A successful exploit could enable an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This could lead to session hijacking, credential theft, redirection to malicious websites, or defacement of the FreeScout interface. The impact is particularly severe because mailbox signatures are often displayed in email communications, potentially affecting recipients beyond the FreeScout user.

1. Reserved2026-04-14
2. Published2026-04-21
3. EPSS updated2026-04-29

The primary mitigation for CVE-2026-40568 is to immediately upgrade FreeScout to version 1.8.213 or later, which includes the necessary sanitization improvements. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious HTML tags and event handlers within mailbox signature submissions. Additionally, review and restrict user permissions related to mailbox signature management to limit the potential attack surface. Monitor FreeScout logs for suspicious activity, such as unusual HTML content in mailbox signatures. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert('XSS')</script>) into a mailbox signature and confirming that it is properly sanitized.