XSS in Freescout-Help-Desk Freescout
CVE-2026-85742
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.
Vulnerability class: XSS (Cross-Site Scripting)
Published .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Freescout-Help-Desk Freescout — versions < 1.8.230
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-85742?
- CVE-2026-85742 is a high-severity vulnerability in Freescout-Help-Desk Freescout, classified under Cross-site Scripting. CVSS score: 7.5/10. Published 2026-11-06.
- How severe is CVE-2026-85742?
- High severity. CVSS v3 base score is 7.5 out of 10.