Home / Vulnerability Intelligence / CVE-2026-40568

CVE-2026-40568 - Vulnerability Analysis

HighCVSS: 8.5

Last Updated: April 21, 2026

FreeScout - Stored XSS

Published: April 21, 2026Updated: April 21, 2026Remote Exploitable

Overview

FreeScout < 1.8.213 contains a stored cross-site scripting vulnerability caused by incomplete sanitization of mailbox signatures, letting authenticated users with signature permission inject arbitrary HTML/JS, triggering on mailbox conversation view.

Severity & Score

Severity: High

CVSS Score: 8.5

Impact

Authenticated users can execute arbitrary JavaScript, enabling session hijacking, phishing, and admin-level actions without victim interaction.

Mitigation

Update to version 1.8.213 or later.

References

https://github.com/freescout-help-desk/freescout/commit/1d83e1cffb0bf8d109625313530b36b0f5910b3f
https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2f5-6wcv-677r

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-40568
Severity: High
CVSS Score: 8.5
Type: stored_xss
Status: new

CWE

CWE-79

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N