FreeScout CVE-2026-40565

The vulnerability requires that an attacker craft an email containing a URL with unescaped double-quote characters (" or \u0022) and send it to a FreeScout-monitored mailbox. The attacker does not need to be authenticated to send email to the help desk inbox. However, exploitation of the resulting XSS payload requires that a FreeScout user (typically a help desk agent or customer) view the email thread in the web interface (UI:R). The vulnerability is NOT triggered in plain-text email clients or if email rendering is disabled. It is specific to FreeScout's web-based email display and requires the linkify() function to process the URL. Default FreeScout configurations with external email integration are vulnerable; isolated internal help desks are at lower risk if emails originate only from trusted internal sources.

The CVSS v3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects a moderate-to-high severity cross-site scripting vulnerability. The network attack vector and low complexity indicate that any remote attacker can craft a malicious email with a poisoned URL. However, the requirement for user interaction (UI:R) - specifically that a help desk agent or customer must view the email thread - limits immediate automated exploitation. The scope change (S:C) indicates the XSS can impact other security domains beyond the vulnerable component (e.g., session theft, lateral movement). The confidentiality and integrity impact scores (C:L/I:L) are conservative; in practice, stored XSS enabling session hijacking or credential theft in a help desk system could have higher impact. No EPSS or KEV status provided; however, the presence of a GitHub advisory and confirmed fix suggests this is a known and disclosed vulnerability rather than an unpatched zero-day. The combination of unauthenticated submission (attackers can send emails to the help desk) and stored persistence in the database makes this a credible threat for help desk deployments exposed to external email. Real-world risk depends heavily on deployment scope: internal-only help desks have lower risk than those receiving untrusted external email.

An attacker sends an email to a FreeScout help desk address with a URL containing an embedded double-quote character, such as: 'Check https://example.com/page" onmouseover="alert(document.cookie)'. When a help desk agent views the email thread, FreeScout's linkify() function converts this into an HTML anchor tag like '<a href="https://example.com/page" onmouseover="alert(document.cookie)">...', injecting the onmouseover event handler. When the agent hovers over or interacts with the link, the JavaScript executes in the agent's browser context, potentially stealing session cookies or credentials.