Stored cross-site scripting in FreeScout job details page
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
FreeScout before 1.8.230 contains a stored cross-site scripting flaw (CWE-79) in the administrator job-details endpoint, which renders failed job payloads after a blacklist sanitizer that leaves event-handler attributes intact. A pre-authenticated attacker who can get HTML into a monitored failed-login email value can trigger this when an alert delivery fails and the payload is stored. When an administrator opens the job-details endpoint as a top-level page, attacker-controlled JavaScript can perform same-origin administrator actions. The attack requires monitoring of users, a failed alert email job, and top-level administrator interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| freescout-help-desk | freescout | before 1.8.230 | 1.8.230 | Patch available | CNA |
- freescout Vendorfreescout-help-desk Affected before 1.8.230 Fixed in 1.8.230 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* | — | — | freescout-help-desk |
- cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* Versions — — ·freescout-help-desk
Remediation
Upgrade FreeScout to version 1.8.230, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA freescout (freescout-help-desk) Fixed in 1.8.230
Timeline
- 2026-11-06 Threatist record created from CVE-2026-85742
- 2026-11-08 Priority changed: MEDIUM → LOW
References
More freescout-help-desk vulnerabilities
- TI-2026-38652 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL CVSS 3.1CRITICAL 9.4
- TI-2026-22019 FreeScout's Predictable Authentication Token Enables Account Takeover CVSS 3.1CRITICAL 9.8
- TI-2026-30304 FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks CVSS 3.1CRITICAL 9.1
- TI-2026-29249 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron CVSS 4.0HIGH 8.9
- TI-2026-29247 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force CVSS 4.0HIGH 8.8
- TI-2026-38648 FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails CVSS 3.1HIGH 8.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences