FreeScout allows a user with updateAutoReply permission to embed a malicious script in a mailbox auto‑reply message. The script is stored unescaped and later injected into every auto‑reply email sent to customers. Email clients do not enforce CSP, so the payload executes in the recipient’s browser or mail‑client context, enabling credential theft, defacement, or other client‑side attacks. It is inferred that the attacker must first obtain or compromise a user with updateAutoReply rights in the system.

The vulnerability exists in versions of FreeScout built on Laravel before 1.8.217. Products affected are those from the freescout‑help‑desk vendor that run the free‑scout application; any system relying on the auto‑reply feature in those releases is vulnerable until patched.

The CVSS score of 7.6 indicates high severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely internal, requiring a privileged user to supply the payload, after which the malicious code is delivered to any customer who contacts the mailbox. The lack of CSP in typical email clients makes the impact wide‑scale for exposed users, and the payload could be used for phishing, data exfiltration, or session hijacking.