CVE-2026-40567

BRIEFING NOTE: CVE-2026-40567 OVERVIEW CVE-2026-40567 is an HTML injection vulnerability affecting FreeScout versions prior to 1.8.213, a free self-hosted help desk and shared mailbox platform. An unauthenticated attacker can inject arbitrary HTML into outgoing support emails by crafting a malicious From display name. The unsanitized input is stored in the database and rendered unescaped in reply emails through the customer full name signature variable, enabling attackers to embed phishing links, tracking pixels, and spoofed content within legitimate organizational communications. SEVERITY The vulnerability carries a CVSS 3.1 score of 5.8 (Medium), reflecting a network-based attack requiring no authentication or user interaction. While the integrity impact is limited, the attack chain presents meaningful risk in the context of business email compromise. The attacker can leverage the trusted source of support emails to conduct targeted phishing campaigns against customers, potentially undermining organizational reputation and enabling secondary attacks. The FAUCET Risk Score of 33.0 out of 100 indicates moderate concern within the broader vulnerability landscape. EXPLOITATION STATUS There is no current evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities list, and the EPSS score of 0.00035 suggests minimal probability of exploitation in real-world scenarios. Patch availability through version 1.8.213 provides clear remediation. Community attention appears limited, indicating this is not a high-priority threat at this time.