CVE-2026-73531

CVE-2026-73531 is a stored XSS in django-helpdesk before version 2.3.3 that exploits a dangerous trust geometry: attackers submit malicious content through an unauthenticated public channel, and that content executes when staff members process tickets as part of their normal workflow. There is no social engineering required, no reflected payload URL to trick someone into clicking, and the victim has no reason to suspect the ticket queue is weaponized. The vulnerability has two independent injection vectors. First, email body content submitted via the public ticket form persists in the database and renders in the staff admin interface without sufficient sanitization. Second, .html and .htm attachments are served without the Content-Disposition: attachment header, causing browsers to render them inline rather than forcing a download. This is not a single sanitization failure—it is two separate code paths with different remediation requirements. Patching one while leaving the other unaddressed leaves the system exploitable. The staff-targeting aspect fundamentally changes the risk profile. A successful exploit doesn't compromise a single user session; it compromises a browser that already holds authentication tokens for LDAP lookups, CRM queries, internal knowledge bases, and escalation workflows. The staff member's session is a relay into whatever systems that role can access. Evaluate what lateral movement is possible from a triage-level staff account in your environment—this may extend well beyond the helpdesk itself. The EPSS score of approximately 6.1 substantially understates actual risk. The scoring model treats this as a generic XSS, but the combination of unauthenticated entry, persistent payload, and privileged-target execution creates exploitation economics that heavily favor the attacker: one injection waits passively until any staff member opens the ticket, with no captcha barriers to prevent enumeration or scaled submission. The absence of rate limiting on public ticket submission compounds this—you should assume the vulnerability is exploitable at scale with minimal detection risk. Prioritize: audit your django-helpdesk version and upgrade to 2.3.3 or later immediately. If upgrade is not feasible, implement application-layer controls: disable inline attachment preview, add captcha to public submission, and consider network-segmenting the helpdesk admin interface from sensitive internal systems. Log ticket source attribution to help identify campaign patterns.

Reviewed through automated stages and approved by a human before publication.