CVE-2026-40497

OVERVIEW CVE-2026-40497 affects FreeScout versions prior to 1.8.213, a free self-hosted help desk and shared mailbox platform. The vulnerability stems from an incomplete remediation of a prior XSS flaw. FreeScout's sanitization function removes dangerous HTML tags including script, form, iframe, and object elements but fails to strip style tags. This allows attackers to inject CSS into the mailbox signature field via the POST /mailbox/settings endpoint. The injected styles are subsequently rendered unescaped in conversation views where they execute within a permissive Content Security Policy that allows unsafe-inline styling. SEVERITY The vulnerability carries a CVSS 3.1 score of 8.1 (HIGH) and requires network access with high privileges and user interaction. An authenticated attacker with mailbox administrative or agent permissions can inject malicious CSS that leverages attribute selectors to exfiltrate CSRF tokens from other administrators or agents who view conversations. Once a CSRF token is captured, the attacker can execute state-changing operations such as creating administrative accounts, modifying credentials, and escalating privileges from agent to administrator level. This represents a significant organizational compromise vector. EXPLOITATION STATUS No active exploitation has been reported, and the vulnerability is not tracked on the Known Exploited Vulnerabilities catalog. EPSS scoring indicates minimal prevalence relative to the overall CVE landscape. However, the flaw is relatively straightforward to exploit for authorized users, making post-disclosure exploitation a realistic concern during the patching window. Organizations running affected versions should prioritize updating to version 1.8.213 or later.