Freescout CVE-2026-32754

FreeScout versions 1.8.208 and below. Unauthenticated attacker sends crafted email with malicious HTML/JavaScript payload. Victim (subscribed agent or admin) must open the email notification in their normal workflow. Vulnerability exists because email bodies stored unsanitized and rendered unescaped in Blade templates using {!! $thread->body !!}.

This vulnerability presents a critical real-world risk with a CVSS score of 9.3, driven by network-based attack vector (AV:N), low attack complexity (AC:L), and no authentication requirement (PR:N). The changed scope (S:C) indicates the vulnerability impacts resources beyond the vulnerable component itself, affecting all email recipients. While user interaction is required (UI:R), this occurs naturally as agents open support tickets as part of their normal workflow. The high confidentiality and integrity impacts (C:H/I:H) reflect potential for session hijacking and account takeover. The lack of EPSS data and absence from CISA KEV catalog suggests no known active exploitation yet, but the trivial exploitation requirement (simply sending an email) and the existence of a public advisory make this a high-priority patch candidate for organizations using FreeScout.

An attacker sends a support email containing malicious JavaScript code embedded in HTML to the FreeScout helpdesk email address. When support agents receive the automatic email notification about the new ticket, the malicious code executes in their email client, potentially stealing session cookies or redirecting to phishing sites. Since the attack requires only sending an email with no authentication and affects all agents simultaneously through the notification system, this represents a highly scalable attack vector for targeting support teams.