{"id":"CVE-2026-85742","title":"FreeScout: Conditional stored admin XSS via failed-job details","summary":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert del…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-79"],"vendor":"freescout-help-desk","product":"freescout","affected":["freescout < 1.8.230"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:15:31.851Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-85742","references":[{"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x","label":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x"},{"url":"https://github.com/freescout-help-desk/freescout/commit/3f508d41a01bd754ef78a7fab38743f141bd1714","label":"https://github.com/freescout-help-desk/freescout/commit/3f508d41a01bd754ef78a7fab38743f141bd1714"},{"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230","label":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T18:00:12.520Z","epss":0.00265,"epssPercentile":0.18503,"slug":"CVE-2026-85742","body":"## Overview\n\nFreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.\n\n## Affected\n\n- `freescout < 1.8.230`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}