SearchSubscribe

TRA-2026-40

Stored XSS in ticket comments enables session takeover

Markdown rendering in comment previews lets an agent-facing script run in a support engineer's session.

  • Patched
  • Web applications

CVSS 3.1 base score

6.4medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vendor
Brightdesk
Product
Brightdesk Service Cloud
CVE
  • CVE-2026-38104
Disclosure
76 days
Researchers
Amira Haddad

Score breakdown

Exploitability

Attack vector
Attack complexity
Privileges required
User interaction

Scope

Scope

Impact

Confidentiality
Integrity
Availability

Affected products

ProductAffectedFixed in
Brightdesk Service Cloud2026.6 – 2026.8.12026.8.2

Questions about this advisory

research@tenable.com
On this page6 sections
  1. Score breakdown
  2. Affected products
  3. Synopsis
  4. Proof of concept
  5. Solution
  6. Disclosure timeline

Synopsis

Markdown rendering in comment previews lets an agent-facing script run in a support engineer’s session.

Proof of concept

Tenable has shared a proof of concept with Brightdesk. It is not published here, to give operators time to apply the fix.

Solution

Upgrade to 2026.8.2 or later. The fix escapes HTML in comment previews and adds a strict Content Security Policy to the agent console.

Disclosure timeline

  1. Tenable reports the issue to Brightdesk

  2. TRA-2026-40 published

76 days from report to publication, against a 90-day policy.How we disclose