FreeScout CSS Injection Allows Privilege Escalation

The National Vulnerability Database has detailed CVE-2026-40497, a high-severity vulnerability (CVSS 8.1) in FreeScout, a self-hosted help desk solution. Versions prior to 1.8.213 are susceptible to a CSS injection flaw stemming from an incomplete fix for a previous XSS vulnerability. Specifically, while the Helper::stripDangerousTags() function was applied to the mailbox signature field, it failed to strip <style> tags, leaving a critical gap.

An attacker with agent-level access, or any access to mailbox settings, can inject malicious CSS attribute selectors into the mailbox signature. When an administrator or another agent views a conversation in that mailbox, the injected CSS executes. This allows the attacker to exfiltrate the victim’s CSRF token. With a valid CSRF token, the attacker can then perform any state-changing action as the victim, including creating new admin accounts or altering existing credentials, effectively escalating privileges from agent to full administrator. This is a direct path to full system compromise.

This isn’t just a theoretical flaw; it’s a bypass of an earlier XSS patch. Defenders running FreeScout must understand that incomplete sanitization is as dangerous as no sanitization at all. The attacker’s calculus here is straightforward: leverage a trusted input field to gain control. Update to FreeScout version 1.8.213 immediately to mitigate this risk.