What is the CVSS score of CVE-2026-41904?

CVE-2026-41904 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of FreeScout are affected by CVE-2026-41904?

CVE-2026-41904 is a stored XSS vulnerability in FreeScout's auto-reply feature that allows authenticated users with specific permissions to inject malicious scripts into customer-facing emails,…. A patch is available.

How to fix or mitigate CVE-2026-41904?

Within 24 hours: Identify all FreeScout deployments running versions prior to 1.8.217 and document current auto-reply configurations. Within 7 days: Apply vendor-released patch to upgrade to FreeScout 1.8.217 or later on all affected instances. Within 30 days: Conduct access review of users with updateAutoReply permission, implement CSP headers where possible, and verify auto-reply content integrity through email security scanning.

FreeScout CVE-2026-41904

EUVD-2026-28407 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-07 GitHub_M

XSS Freescout

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 07, 2026 - 20:02 EUVD

Source Code Evidence Fetched

May 07, 2026 - 19:45 vuln.today

Analysis Generated

May 07, 2026 - 19:45 vuln.today

CVE Published

May 07, 2026 - 18:05 nvd

HIGH 7.6

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, a user with updateAutoReply permission can store an XSS payload in the mailbox auto-reply message. The payload is rendered unescaped in the auto-reply email sent to every customer who contacts the mailbox. Email clients do not enforce CSP, so the payload executes in the customer's webmail / mail-client context. This issue has been patched in version 1.8.217.

AnalysisAI

Stored XSS in FreeScout's auto-reply feature allows authenticated users with updateAutoReply permission to inject malicious scripts that execute in customer email clients. Every customer contacting the affected mailbox receives the weaponized auto-reply email, where the payload executes without CSP protection in webmail or email client contexts. The vulnerability affects FreeScout versions prior to 1.8.217, which contains the vendor-released patch. EPSS data not provided, no CISA KEV listing indicates limited observed exploitation despite the chain-reaction impact potential.

Technical ContextAI

FreeScout is an open-source help desk and shared inbox application built on PHP's Laravel framework. The vulnerability resides in the auto-reply message functionality where user input is stored in the mailbox configuration but rendered without proper output encoding in outbound email HTML. CWE-79 (Cross-Site Scripting) classification indicates insufficient neutralization of input during web page generation. Email clients traditionally lack Content Security Policy enforcement, creating a trust boundary issue where server-side XSS filtering failures propagate directly to client-side execution environments. The CVSS scope change (S:C) reflects this boundary crossing from the FreeScout application context to customer email client contexts.

RemediationAI

Upgrade to FreeScout version 1.8.217 or later, which includes improved sanitization of auto-reply messages per the release notes at https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217. The patch implements proper output encoding for auto-reply content before rendering in email HTML. If immediate upgrade is not feasible, restrict updateAutoReply permissions to only highly trusted administrative users and audit existing auto-reply messages for suspicious HTML/JavaScript content. Note that permission restriction does not remediate existing malicious payloads already stored in mailbox configurations-these must be manually reviewed and sanitized. As a compensating control, configure email gateway or client-side filtering to strip script tags from outbound auto-replies, though this may affect legitimate HTML formatting and does not protect customers using permissive email clients.