What is the CVSS score of CVE-2026-32754?

CVE-2026-32754 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Freescout are affected by CVE-2026-32754?

FreeScout help desk systems running version 1.8.208 or below are vulnerable to stored XSS attacks through email notifications, allowing unauthenticated attackers to inject malicious code that affects…

How to fix or mitigate CVE-2026-32754?

Within 24 hours: Audit FreeScout deployment to confirm version and affected systems; notify all help desk staff to avoid opening email notifications from external sources and disable email notification features if possible. Within 7 days: Implement email client security controls (disable HTML rendering, require plain text mode) and deploy WAF rules to block script injection patterns in incoming mail. Within 30 days: Upgrade to FreeScout version 1.8.209 or later, conduct security awareness training for staff on phishing/email threats, and review email logs for suspicious injection attempts.

Freescout CVE-2026-32754

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 GitHub_M

XSS Freescout

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 19, 2026 - 22:00 vuln.today

CVE Published

Mar 19, 2026 - 21:35 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) through FreeScout's email notification templates. Incoming email bodies are stored in the database without sanitization and rendered unescaped in outgoing email notifications using Blade's raw output syntax {!! $thread->body !!}. An unauthenticated attacker can exploit this vulnerability by simply sending an email, and when opened by any subscribed agent or admin as part of their normal workflow, enabling universal HTML injection (phishing, tracking) and, in vulnerable email clients, JavaScript execution (session hijacking, credential theft, account takeover) affecting all recipients simultaneously. This issue has been fixed in version 1.8.209.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in FreeScout help desk software versions 1.8.208 and below, where malicious email content is stored unsanitized and executed when email notifications are sent to agents. An unauthenticated attacker can exploit this by simply sending a specially crafted email that executes malicious scripts when viewed by support staff in their email clients, potentially leading to session hijacking, credential theft, and account takeover. The vulnerability has a critical CVSS score of 9.3 due to its ease of exploitation and broad impact across all notification recipients.

Technical ContextAI

FreeScout is a PHP Laravel-based help desk application (CPE: cpe:2.3:a:freescout-help-desk:freescout:*:*:*:*:*:*:*:*) that processes incoming support emails and generates notification emails to agents. The vulnerability stems from improper neutralization of input during web page generation (CWE-79), specifically in the email notification template system where email bodies are rendered using Blade's raw output syntax {!! $thread->body !!} without proper sanitization. This allows HTML and potentially JavaScript code from incoming emails to be stored in the database and later executed in the context of email clients when notifications are sent, creating a stored XSS condition that affects all recipients of the notification emails.

RemediationAI

Upgrade FreeScout to version 1.8.209 or later immediately, which includes the security fix documented in commit 3329379db38a86cf7069b0709061b95a7d38985b. The patched version is available at https://github.com/freescout-help-desk/freescout/releases/tag/1.8.209. Until patching is possible, consider implementing email content filtering at the mail server level to strip HTML content from incoming emails, though this may impact legitimate formatting. Additionally, ensure agents use email clients with robust XSS protections and disable automatic loading of external content in emails.