FreeScout CVE-2026-41904

Attacker must possess authenticated FreeScout account with updateAutoReply permission granted-this is not a default permission for all users but requires administrative role assignment. Attack succeeds only when targeted customers open HTML-formatted emails in clients that render JavaScript (most modern webmail interfaces). Exploitation is limited by organizational permission model (how restrictively updateAutoReply is granted), email client security posture (some enterprise clients block script execution), and customer behavior (text-only email readers are immune). The CVSS vector PR:L and UI:R confirm these authentication and interaction requirements. Scope change (S:C) indicates the vulnerability crosses from authenticated FreeScout context to unauthenticated customer email context.

CVSS 7.6 (High) with network attack vector (AV:N), low complexity (AC:L), but requiring low privileges (PR:L) and user interaction (UI:R). The changed scope (S:C) and high confidentiality impact (C:H) reflect the vulnerability's ability to breach trust boundaries between the helpdesk system and customer email clients. However, real-world risk is tempered by multiple prerequisites: attacker needs authenticated FreeScout account with specific updateAutoReply permission, and customers must open HTML emails and interact with malicious content. No EPSS score provided limits quantitative exploitation probability assessment. Absence from CISA KEV and no public POC reference suggests exploitation remains theoretical rather than widespread. The attack chain's reliance on both insider access and victim interaction reduces immediate urgency compared to unauthenticated RCE vulnerabilities, but the potential for credential harvesting across entire customer bases via a single malicious auto-reply makes this a significant trust and data protection concern for organizations using FreeScout.

An attacker with a low-privileged FreeScout account and updateAutoReply permission navigates to mailbox settings and injects JavaScript payload into the auto-reply message field (e.g., script tag with credential-stealing code or session token exfiltration). When customers email the helpdesk, they receive the auto-reply containing the unescaped payload. Opening the email in webmail clients like Gmail or Outlook Web App executes the script in the customer's browser context, potentially stealing session cookies, credentials, or sensitive email content and exfiltrating data to attacker-controlled servers.