---
id: CVE-2026-85742
title: 'FreeScout: Conditional stored admin XSS via failed-job details'
summary: >-
  FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a
  pre-authenticated attacker can place HTML in a failed-login email value that
  is copied through monitored user activity into a queued SendAlert job. If
  alert del…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-79
vendor: freescout-help-desk
product: freescout
affected:
  - freescout < 1.8.230
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:15:31.851Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85742'
references:
  - url: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x
    label: >-
      https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x
  - url: >-
      https://github.com/freescout-help-desk/freescout/commit/3f508d41a01bd754ef78a7fab38743f141bd1714
    label: >-
      https://github.com/freescout-help-desk/freescout/commit/3f508d41a01bd754ef78a7fab38743f141bd1714
  - url: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230'
    label: 'https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230'
tags:
  - cve.org
ingestedAt: '2026-11-06T18:00:12.520Z'
epss: 0.00265
epssPercentile: 0.18503
---

## Overview

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.

## Affected

- `freescout < 1.8.230`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.