CVE-2026-40497-nvd.nist.gov-Undergoing Analysis

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's `Helper::stripDangerousTags()` removes `<script>`, `<form>`,…

Published:

20 April 2026 at 22:00:00

Alert date:

21 April 2026 at 17:05:49

Source:

nvd.nist.gov

Web Technologies, Enterprise Applications

FreeScout help desk software versions prior to 1.8.213 contain a CSS injection vulnerability in the mailbox signature field. The Helper::stripDangerousTags() function fails to remove <style> tags, allowing attackers with mailbox access to inject malicious CSS. The vulnerability enables CSS attribute selectors to exfiltrate CSRF tokens from admin/agent users viewing conversations. Stolen CSRF tokens can be used for privilege escalation attacks, allowing agents to perform admin actions like creating accounts or changing passwords. This represents an incomplete fix for a previous XSS vulnerability (GHSA-jqjf-f566-485j). The issue is resolved in version 1.8.213.

Technical details

Mitigation steps:

Affected products:

FreeScout