{"id":"CVE-2026-85742","kind":"vulnerability","aliases":["CVE-2026-85742"],"related":[],"title":"FreeScout: failed-login email HTML runs script in admin's browser","description":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.","summary":"FreeScout's administrator job-details page renders stored alert-job payloads after a sanitizer that keeps event-handler attributes, so HTML from a failed-login email value can execute. An attacker who can trigger a failed login can run JavaScript in an administrator's session and perform administrator actions on the same origin.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freescout","help-desk","package","php","self-hosted"],"not_affected_if":["default-config","modal-only-use"],"how_to_check":"- Check the FreeScout version in use; versions below `1.8.230` are affected.\n- Confirm whether Logs Monitoring is enabled and whether the failed_jobs table holds SendAlert jobs.","fix":"- FreeScout: move to `1.8.230` or later.","status":"open","published_at":"2026-11-06T18:18:21+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","triaged_at":"2026-11-06T18:45:13+00:00","updated_at":"2026-11-06T18:45:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T18:45:13Z","model":"claude-haiku-5-5","output":{"fix":"- FreeScout: move to `1.8.230` or later.","reach":"internet","title":"FreeScout: failed-login email HTML runs script in admin's browser","impact":"high","summary":"FreeScout's administrator job-details page renders stored alert-job payloads after a sanitizer that keeps event-handler attributes, so HTML from a failed-login email value can execute. An attacker who can trigger a failed login can run JavaScript in an administrator's session and perform administrator actions on the same origin.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freescout","self-hosted","help-desk","php"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker script performs administrator actions in the admin's session","analyst_note":"","how_to_check":"- Check the FreeScout version in use; versions below `1.8.230` are affected.\n- Confirm whether Logs Monitoring is enabled and whether the failed_jobs table holds SendAlert jobs.\n- unknown for any other check the sources do not state.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","modal-only-use"],"who_is_affected":"Self-hosted FreeScout installations before 1.8.230 that have Logs Monitoring enabled and a failing alert email job, and where an administrator opens the job-details endpoint as a top-level page. The normal modal path is not affected in the tested configuration, so teams that only use the modal can deprioritize it but should still upgrade.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4442,"output_tokens":562,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-85742':15A,18A '/system/ajax-html/job_details':162C '1.8.230':98C,228C 'action':80B,189C 'activ':120C 'admin':10A 'administr':30B,74B,79B,140C,160C,188C,206C 'affect':217C 'alert':38B,127C,196C 'alert-job':37B 'attack':62B,103C,180C 'attacker-control':179C 'attribut':49B,157C 'authent':102C 'blacklist':149C 'browser':12A 'configur':221C 'control':181C 'copi':116C 'cve':13A,16A 'deliveri':128C 'desk':22B,92C 'detail':33B,143C 'email':5A,57B,112C,197C 'endpoint':144C 'event':47B,155C 'event-handl':46B,154C 'execut':60B,153C 'fail':3A,55B,67B,110C,129C,136C,195C 'failed-login':2A,54B,109C 'failur':200C 'fix':225C 'fragment':172C 'freescout':1A,19B,28B,85C 'handler':48B,156C 'help':21B,91C 'help-desk':20B 'host':27B,90C 'html':6A,51B,106C 'id':163C 'interact':207C 'issu':223C 'javascript':71B,182C 'job':32B,39B,125C,137C,142C,198C 'job-detail':31B,141C 'keep':45B 'lack':173C 'layout':176C 'leav':152C 'level':168C,205C 'log':190C 'login':4A,56B,68B,111C 'mailbox':95C 'modal':213C 'monitor':118C,191C 'normal':175C,212C 'open':161C 'origin':84B,187C 'packag':23B 'page':34B,169C 'path':214C 'payload':40B,132C 'perform':78B,184C 'php':24B 'place':105C 'polici':177C 'pre':101C 'pre-authent':100C 'prior':96C 'queu':123C 'queue':199C 'raw':171C 'render':35B,145C 'requir':210C 'run':7A,70B 'same-origin':185C 'sanit':43B,150C 'script':8A 'self':26B,89C 'self-host':25B,88C 'sendalert':124C 'serial':131C 'session':76B 'share':94C 'storag':201C 'store':36B,134C 'test':220C 'top':167C,204C 'top-level':166C,203C 'trigger':65B 'user':119C,193C 'valu':58B,113C 'version':227C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FreeScout installations before 1.8.230 that have Logs Monitoring enabled and a failing alert email job, and where an administrator opens the job-details endpoint as a top-level page. The normal modal path is not affected in the tested configuration, so teams that only use the modal can deprioritize it but should still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freescout","helpdesk","high","package","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-85742':15A,18A 'admin':10A 'browser':12A 'cve':13A,16A 'email':5A 'fail':3A 'failed-login':2A 'freescout':1A 'html':6A 'login':4A 'run':7A 'script':8A","search_b":"'action':80B 'administr':30B,74B,79B 'alert':38B 'alert-job':37B 'attack':62B 'attribut':49B 'desk':22B 'detail':33B 'email':57B 'event':47B 'event-handl':46B 'execut':60B 'fail':55B,67B 'failed-login':54B 'freescout':19B,28B 'handler':48B 'help':21B 'help-desk':20B 'host':27B 'html':51B 'javascript':71B 'job':32B,39B 'job-detail':31B 'keep':45B 'login':56B,68B 'origin':84B 'packag':23B 'page':34B 'payload':40B 'perform':78B 'php':24B 'render':35B 'run':70B 'sanit':43B 'self':26B 'self-host':25B 'session':76B 'store':36B 'trigger':65B 'valu':58B","search_c":"'/system/ajax-html/job_details':162C '1.8.230':98C,228C 'action':189C 'activ':120C 'administr':140C,160C,188C,206C 'affect':217C 'alert':127C,196C 'attack':103C,180C 'attacker-control':179C 'attribut':157C 'authent':102C 'blacklist':149C 'configur':221C 'control':181C 'copi':116C 'deliveri':128C 'desk':92C 'detail':143C 'email':112C,197C 'endpoint':144C 'event':155C 'event-handl':154C 'execut':153C 'fail':110C,129C,136C,195C 'failed-login':109C 'failur':200C 'fix':225C 'fragment':172C 'freescout':85C 'handler':156C 'help':91C 'host':90C 'html':106C 'id':163C 'interact':207C 'issu':223C 'javascript':182C 'job':125C,137C,142C,198C 'job-detail':141C 'lack':173C 'layout':176C 'leav':152C 'level':168C,205C 'log':190C 'login':111C 'mailbox':95C 'modal':213C 'monitor':118C,191C 'normal':175C,212C 'open':161C 'origin':187C 'page':169C 'path':214C 'payload':132C 'perform':184C 'place':105C 'polici':177C 'pre':101C 'pre-authent':100C 'prior':96C 'queu':123C 'queue':199C 'raw':171C 'render':145C 'requir':210C 'same-origin':185C 'sanit':150C 'self':89C 'self-host':88C 'sendalert':124C 'serial':131C 'share':94C 'storag':201C 'store':134C 'test':220C 'top':167C,204C 'top-level':166C,203C 'user':119C,193C 'valu':113C 'version':227C","first_public_at":"2026-08-14T13:35:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85742","severity":null,"published_at":"2026-11-06T18:18:21+00:00","modified_at":"2026-11-06T18:18:21+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","fetched_at":"2026-11-06T18:44:09+00:00","note":null}],"documents":[{"id":88853,"url":"https://github.com/freescout-help-desk/freescout/commit/3f508d41a01bd754ef78a7fab38743f141bd1714","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88403,"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88855,"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-14T13:35:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}