CVE-2026-32754 Details
Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) through FreeScout's email notification templates. Incoming email bodies are stored in the database without sanitization and rendered unescaped in outgoing email notifications using Blade's raw output syntax {!! $thread->body !!}. An unauthenticated attacker can exploit this vulnerability by simply sending an email, and when opened by any subscribed agent or admin as part of their normal workflow, enabling universal HTML injection (phishing, tracking) and, in vulnerable email clients, JavaScript execution (session hijacking, credential theft, account takeover) affecting all recipients simultaneously. This issue has been fixed in version 1.8.209.
A stored cross-site scripting vulnerability has been identified in FreeScout, a help desk and shared inbox application built on PHP's Laravel framework. This issue affects versions through 1.8.208. The vulnerability arises because incoming email bodies are saved in the database without proper sanitization and are later rendered unescaped in outgoing email notifications using Blade's raw output syntax. An unauthenticated attacker can exploit this by sending an email with a malicious payload, which, when opened by a subscribed agent or admin, injects HTML or JavaScript that could be executed in vulnerable email clients, leading to session hijacking or credential theft. This vulnerability impacts all recipients of the notification email simultaneously.
Users can update to FreeScout version 1.8.209, which addresses this vulnerability by sanitizing email bodies before they are rendered in notifications.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/freescout-help-desk/freescout/commit/3329379db38a86cf7069b0709061b95a7d38985b | [email protected] | Patch |
| https://github.com/freescout-help-desk/freescout/releases/tag/1.8.209 | [email protected] | ProductRelease Notes |
| https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-56h2-5556-r6mg | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freescout freescout | < 1.8.209 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |