PT-2026-38549 · Freescout · Freescout

Whatisproblem · Published 2026-05-07 · Updated 2026-05-08 · CVE-2026-41904

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.217

Description A user with updateAutoReply permission can store a Cross-Site Scripting (XSS) payload in the mailbox auto-reply message. This payload is rendered without escaping in the auto-reply emails sent to customers. Since email clients typically do not enforce Content Security Policy (CSP), the payload executes within the context of the customer's webmail or mail client.

Recommendations Update to version 1.8.217.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41904

Affected Products

Freescout

References · 8

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-q3fh-rj9h-jfrc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41904 · Security Note
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.217 · Note
• https://twitter.com/infoflowcloud/status/2052479058504487181 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2052478601883156995 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052545599250043044 · Twitter Post
• https://t.me/CVEtracker/53004 · Telegram Post
• https://twitter.com/CVEnew/status/2052477955121569942 · Twitter Post