{"id":"CVE-2026-62854","kind":"vulnerability","aliases":["CVE-2026-62854"],"related":[],"title":"FreeScout: mailbox signature XSS lets attacker run scripts in other users' sessions","description":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting external script is served from the same origin, so the script-src 'self' policy permits it when another user opens the affected mailbox reply editor or new-ticket page. The script executes with the victim's FreeScout privileges and can read visible data and perform same-origin actions. This issue is fixed in version 1.8.225.","summary":"FreeScout, a self-hosted help desk, lets a user who can edit a mailbox signature upload a scriptable file and bypass tag stripping so the file loads as a script. When another user opens the affected mailbox reply editor or new-ticket page, the script runs with that user's FreeScout privileges, reading visible data and acting as them.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freescout","helpdesk","package","self-hosted"],"not_affected_if":["fixed-version-1.8.225","no-signature-editors"],"how_to_check":"- Check the FreeScout version in the installed application; versions below `1.8.225` are affected.\n- Review who can edit mailbox signatures in the admin settings.\n- Look for unexpected uploaded script-like files under the uploads directory.","fix":"- FreeScout: upgrade to `1.8.225`.","status":"open","published_at":"2026-11-06T17:18:33+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","triaged_at":"2026-11-06T17:45:02+00:00","updated_at":"2026-11-06T17:45:02+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T17:45:02Z","model":"claude-haiku-5-5","output":{"fix":"- FreeScout: upgrade to `1.8.225`.","reach":"network","title":"FreeScout: mailbox signature XSS lets attacker run scripts in other users' sessions","impact":"high","summary":"FreeScout, a self-hosted help desk, lets a user who can edit a mailbox signature upload a scriptable file and bypass tag stripping so the file loads as a script. When another user opens the affected mailbox reply editor or new-ticket page, the script runs with that user's FreeScout privileges, reading visible data and acting as them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freescout","self-hosted","helpdesk"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs as other staff, reading visible data and acting","analyst_note":"","how_to_check":"- Check the FreeScout version in the installed application; versions below `1.8.225` are affected.\n- Review who can edit mailbox signatures in the admin settings.\n- Look for unexpected uploaded script-like files under the uploads directory.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version-1.8.225","no-signature-editors"],"who_is_affected":"Teams running self-hosted FreeScout before 1.8.225 where some users can edit mailbox signatures. Exposure needs a user with signature-edit rights and another user opening the affected mailbox pages; hosted or patched installs can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4359,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-62854':15A,18A '/uploads/upload':113C '1.8.225':97C,181C 'act':83B 'action':174C 'affect':61B,146C 'anoth':57B,142C 'attack':6A 'bypass':46B,119C 'combin':107C 'cve':13A,16A 'data':81B,168C 'desk':31B,91C 'edit':37B,102C 'editor':64B,149C 'execut':157C 'extern':124C 'file':44B,51B,110C 'fix':178C 'fragment':117C 'freescout':1A,19B,25B,77B,84C,162C 'help':30B,90C 'helpdesk':20B 'helper':120C 'host':24B,29B,89C 'issu':176C 'let':5A,32B 'load':52B 'mailbox':2A,39B,62B,94C,104C,147C 'nest':115C 'new':67B,152C 'new-ticket':66B,151C 'open':59B,144C 'origin':131C,173C 'packag':21B 'page':69B,154C 'perform':170C 'permit':139C 'polici':138C 'prior':95C 'privileg':78B,163C 'read':79B,166C 'repli':63B,148C 'result':123C 'run':7A,72B 'same-origin':171C 'script':8A,55B,71B,125C,135C,156C 'script-src':134C 'scriptabl':43B,109C 'self':23B,28B,88C,137C 'self-host':22B,27B,87C 'serv':127C 'session':12A 'share':93C 'signatur':3A,40B,105C 'src':136C 'strip':48B 'stripdangeroustag':121C 'tag':47B,116C 'ticket':68B,153C 'upload':41B,111C 'user':11A,34B,58B,75B,99C,143C 'version':180C 'victim':160C 'visibl':80B,167C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted FreeScout before 1.8.225 where some users can edit mailbox signatures. Exposure needs a user with signature-edit rights and another user opening the affected mailbox pages; hosted or patched installs can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freescout","helpdesk","high","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-62854':15A,18A 'attack':6A 'cve':13A,16A 'freescout':1A 'let':5A 'mailbox':2A 'run':7A 'script':8A 'session':12A 'signatur':3A 'user':11A 'xss':4A","search_b":"'act':83B 'affect':61B 'anoth':57B 'bypass':46B 'data':81B 'desk':31B 'edit':37B 'editor':64B 'file':44B,51B 'freescout':19B,25B,77B 'help':30B 'helpdesk':20B 'host':24B,29B 'let':32B 'load':52B 'mailbox':39B,62B 'new':67B 'new-ticket':66B 'open':59B 'packag':21B 'page':69B 'privileg':78B 'read':79B 'repli':63B 'run':72B 'script':55B,71B 'scriptabl':43B 'self':23B,28B 'self-host':22B,27B 'signatur':40B 'strip':48B 'tag':47B 'ticket':68B 'upload':41B 'user':34B,58B,75B 'visibl':80B","search_c":"'/uploads/upload':113C '1.8.225':97C,181C 'action':174C 'affect':146C 'anoth':142C 'bypass':119C 'combin':107C 'data':168C 'desk':91C 'edit':102C 'editor':149C 'execut':157C 'extern':124C 'file':110C 'fix':178C 'fragment':117C 'freescout':84C,162C 'help':90C 'helper':120C 'host':89C 'issu':176C 'mailbox':94C,104C,147C 'nest':115C 'new':152C 'new-ticket':151C 'open':144C 'origin':131C,173C 'page':154C 'perform':170C 'permit':139C 'polici':138C 'prior':95C 'privileg':163C 'read':166C 'repli':148C 'result':123C 'same-origin':171C 'script':125C,135C,156C 'script-src':134C 'scriptabl':109C 'self':88C,137C 'self-host':87C 'serv':127C 'share':93C 'signatur':105C 'src':136C 'stripdangeroustag':121C 'tag':116C 'ticket':153C 'upload':111C 'user':99C,143C 'version':180C 'victim':160C 'visibl':167C","first_public_at":"2026-07-15T09:58:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62854","severity":null,"published_at":"2026-11-06T17:18:33+00:00","modified_at":"2026-11-06T17:18:33+00:00","first_seen_at":"2026-11-06T17:43:14+00:00","fetched_at":"2026-11-06T17:43:14+00:00","note":null}],"documents":[{"id":88390,"url":"https://github.com/freescout-help-desk/freescout/commit/315ad05f73886649cb8bc2c014dd74b62cc28502","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88391,"url":"https://github.com/freescout-help-desk/freescout/commit/7f6a5042c1326ceaf511f13982178dce036cedbe","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88382,"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88393,"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-15T09:58:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}