{"id":"CVE-2026-85742","published":"2026-11-06T18:18:21.143","lastModified":"2026-11-10T20:19:37.587","description":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/freescout-help-desk/freescout/commit/3f508d41a01bd754ef78a7fab38743f141bd1714","tags":[]},{"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230","tags":[]},{"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x","tags":[]},{"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x","tags":[]}],"exploitRefs":[{"url":"https://github.com/freescout-help-desk/freescout/commit/3f508d41a01bd754ef78a7fab38743f141bd1714","tags":[]},{"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230","tags":[]},{"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x","tags":[]},{"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x","tags":[]}],"hasPoc":true,"ai":null}