FreeScout fails to strip <style> tags from mailbox signatures. When a signature containing inline CSS is stored, it is rendered with unsafe HTML, allowing attackers who can edit mailbox settings to inject CSS selectors that read the CSRF token of any user who views a conversation. The stolen token enables the attacker to perform state‑changing actions as that user, such as creating administrative accounts or changing passwords, effectively escalating from an agent to an administrator. This flaw is categorized as a stored cross‑site scripting vulnerability (CWE‑79).

The vulnerability affects all FreeScout installations running a version older than 1.8.213. The issue is present in the freescout-help-desk:freescout product before this release and was fully addressed in the 1.8.213 update.

The CVSS base score of 8.1 indicates a high severity risk, although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploitation yet. Exploitation requires authenticated access to mailbox settings, meaning the attacker must be a user with mailbox management privileges (admin or agent). Once the privilege escalation occurs, any authenticated action can be abused. Because the flaw relies on stored data, an attacker could persist the exploit through repeated sessions but would need to maintain credentials to inject the malicious signature.