CVE-2026-41904 in freescout
Summary
by MITRE • 05/07/2026
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with updateAutoReply permission can store an XSS payload in the mailbox auto-reply message. The payload is rendered unescaped in the auto-reply email sent to every customer who contacts the mailbox. Email clients do not enforce CSP, so the payload executes in the customer's webmail / mail-client context. This issue has been patched in version 1.8.217.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/20/2026
This vulnerability exists within FreeScout, a PHP-based help desk and shared inbox application built on the Laravel framework, where a specific privilege escalation scenario enables cross-site scripting attacks through automated email responses. The flaw specifically targets users who possess the updateAutoReply permission, granting them the ability to inject malicious code into the system's auto-reply message configuration. When customers contact the affected mailbox, the system sends automated emails containing the stored payload, which executes in the recipient's email client environment without proper sanitization or escaping mechanisms. The vulnerability represents a classic server-side template injection combined with client-side execution, creating a persistent threat vector that can compromise end-user systems through routine email interactions.
The technical implementation of this vulnerability stems from inadequate input validation and output encoding within the auto-reply message handling component of the Laravel application. When administrators or authorized users modify the auto-reply message content, the system fails to properly sanitize or escape special characters that could be interpreted as HTML or JavaScript code. This weakness allows attackers to inject malicious scripts that execute within the victim's email client context, bypassing traditional web application security controls. The absence of content security policy enforcement by email clients means that the injected payloads can leverage the privileges and trust level of the user's email environment, potentially enabling more sophisticated attacks such as credential theft, session hijacking, or further malware delivery. This vulnerability directly maps to CWE-79 which addresses cross-site scripting flaws, and could be categorized under ATT&CK technique T1566 for spearphishing with a malicious attachment or link, though in this case the attack vector is through email content itself rather than attachments.
The operational impact of this vulnerability extends beyond simple script execution, as it creates a persistent threat that can affect multiple users over time. Every customer interaction with the compromised mailbox triggers the execution of the stored payload, making this a scalable attack vector that can reach numerous recipients. Email clients typically do not enforce strict security policies that would prevent script execution, particularly in the context of legitimate auto-reply messages, which are often treated with elevated trust. This creates a unique attack surface where the application's own legitimate functionality becomes weaponized against its users, potentially allowing attackers to harvest credentials from email clients, redirect users to malicious sites, or establish persistent backdoors through the email communication channel. The vulnerability's exploitation requires minimal privileges and can remain undetected for extended periods, as the malicious code executes silently in the background of routine email communications.
Organizations using FreeScout should implement immediate mitigation strategies including upgrading to version 1.8.217 or later, which contains the necessary patches to address the XSS vulnerability. Additionally, administrators should review and restrict permissions for users who have updateAutoReply capabilities, ensuring that only trusted personnel can modify auto-reply messages. Input validation should be strengthened to sanitize all user-supplied content in auto-reply fields, and output encoding should be enforced to prevent script execution in email contexts. Security monitoring should be enhanced to detect unusual patterns in auto-reply message modifications, and regular security audits should verify that no malicious payloads have been previously injected into the system. The mitigation approach should align with security best practices outlined in OWASP Top 10 and NIST cybersecurity frameworks, focusing on defense in depth strategies that protect both application integrity and user security.