CVE-2026-40497: FreeScout Privilege Escalation Flaw

CVE-2026-40497 Overview

CVE-2026-40497 is a CSS Injection vulnerability affecting FreeScout, a free self-hosted help desk and shared mailbox application. The vulnerability exists due to an incomplete fix for a previous security advisory (GHSA-jqjf-f566-485j). While the Helper::stripDangerousTags() function removes <script>, <form>, <iframe>, and <object> tags, it fails to strip <style> tags from the mailbox signature field. This oversight allows attackers with access to mailbox settings to inject malicious CSS that can exfiltrate CSRF tokens from other users viewing conversations in the affected mailbox.

Critical Impact

An attacker with mailbox settings access (admin or agent with mailbox permission) can leverage CSS attribute selectors to steal CSRF tokens, enabling privilege escalation from agent to admin and allowing unauthorized state-changing actions such as creating admin accounts or modifying user credentials.

Affected Products

• FreeScout versions prior to 1.8.213
• Self-hosted FreeScout help desk installations
• FreeScout shared mailbox deployments

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40497 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40497

Vulnerability Analysis

This vulnerability stems from an incomplete remediation of a previously reported XSS issue in FreeScout's mailbox signature handling. The original vulnerability allowed Cross-Site Scripting attacks through the mailbox signature field, which was addressed by implementing the Helper::stripDangerousTags() sanitization function. However, this function only strips a limited set of dangerous HTML tags (script, form, iframe, and object), leaving <style> tags completely unfiltered.

The mailbox signature is saved via a POST request to /mailbox/settings/{id} and subsequently rendered without proper escaping using the Blade template syntax {!! $conversation->getSignatureProcessed([], true) !!}. The double exclamation marks in Blade indicate raw, unescaped output, which directly outputs the signature content including any injected <style> tags.

Compounding the issue, the application's Content Security Policy (CSP) is configured with style-src * 'self' 'unsafe-inline', which explicitly permits inline styles to execute without restriction. This permissive CSP configuration enables the injected CSS to function as intended by the attacker.

Root Cause

The root cause is twofold: first, the incomplete sanitization in Helper::stripDangerousTags() that fails to account for CSS injection attacks via <style> tags; second, the use of unescaped output rendering ({!! !!}) for user-controlled content in conjunction with an overly permissive Content Security Policy that allows 'unsafe-inline' styles.

Attack Vector

The attack leverages CSS attribute selectors to perform a side-channel data exfiltration technique. An attacker with access to mailbox settings injects carefully crafted CSS rules into the signature field. These CSS selectors can match against input elements containing the CSRF token, using attribute substring matching to leak the token character by character through background image requests to an attacker-controlled server.

When a victim (admin or another agent) views a conversation in the affected mailbox, the injected styles execute in their browser context. The CSS rules trigger outbound requests that encode the CSRF token value. Once the attacker obtains the victim's CSRF token, they can forge requests to perform any state-changing action as the victim, including creating new administrator accounts, changing email addresses or passwords, and modifying system configurations.

Detection Methods for CVE-2026-40497

Indicators of Compromise

• Unusual <style> tags present in mailbox signature fields containing CSS attribute selectors
• Outbound requests from user browsers to unknown external domains triggered during conversation viewing
• Mailbox signature configurations containing CSS rules with input[value^= or similar attribute selectors
• Unexpected administrative account creations or privilege changes

Detection Strategies

• Monitor mailbox signature fields for HTML content containing <style> tags
• Implement Content Security Policy violation reporting to detect inline style injections
• Audit administrative actions for anomalies following signature field modifications
• Review web server logs for unusual POST requests to /mailbox/settings/ endpoints with HTML payloads

Monitoring Recommendations

• Enable logging for all mailbox configuration changes in FreeScout
• Implement browser-side monitoring for CSP violations related to style-src directives
• Set up alerts for new administrator account creations or privilege escalation events
• Monitor for unusual patterns in user session activity following mailbox access

How to Mitigate CVE-2026-40497

Immediate Actions Required

• Upgrade FreeScout to version 1.8.213 or later immediately
• Audit existing mailbox signatures for any injected <style> tags or suspicious CSS content
• Review recent administrative actions and account changes for signs of compromise
• Rotate CSRF tokens and invalidate existing sessions as a precaution

Patch Information

FreeScout has released version 1.8.213 which contains an updated fix addressing this CSS injection vulnerability. The patch extends the stripDangerousTags() function to also remove <style> tags from user-supplied content. Organizations should apply this update immediately. For technical details, refer to the GitHub Security Advisory GHSA-fh99-wr77-pxq3 and the associated commit.

Workarounds

• If immediate patching is not possible, manually audit and sanitize all mailbox signature fields to remove <style> tags
• Restrict mailbox settings access to only trusted administrators until the patch is applied
• Implement a stricter Content Security Policy that removes 'unsafe-inline' from style-src directives
• Consider temporarily disabling custom mailbox signatures until the update can be deployed

# Upgrade FreeScout to patched version
cd /var/www/freescout
git fetch --all --tags
git checkout 1.8.213
php artisan freescout:after-app-update