Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85742— FreeScout: Conditional stored admin XSS via failed-job details

Quick assessment

Affected
freescout-help-desk freescout
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FreeScout 是一款自托管的工单系统与共享邮箱解决方案。在 1.8.230 版本之前，未通过身份验证的攻击者可在登录失败的邮件内容中注入 HTML。该 HTML 会被复制到监控用户活动的记录中，并作为待处理的 SendAlert 任务进入队列。若警报投递失败，序列化的攻击载荷将被存储至 failed_jobs 表中；当管理员访问 job-details 接口时，系统会经过一个黑名单过滤器后渲染该载荷，但该过滤器未能清除可执行的事件处理器（event-handler）属性。若管理员将 作为顶层页面直接打开，原始

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85742

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FreeScout: Conditional stored admin XSS via failed-job details
Source: CVE Program / CVE List V5
Vulnerability Description
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
freescout-help-desk freescout < 1.8.230 -

II. Public POCs for CVE-2026-85742

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85742

请登录查看更多情报信息。

Other References for CVE-2026-85742 (3)

Same Patch Batch · freescout-help-desk · 2026-11-06 · 11 CVEs total

CVE-2026-85743 8.2 HIGH FreeScout: Server-side request forgery via incomplete outbound host validation and unguard
CVE-2026-62856 7.7 HIGH FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast
CVE-2026-62854 7.6 HIGH FreeScout: Stored XSS in mailbox signature via same-origin JS upload
CVE-2026-103985 7.1 HIGH FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversa
CVE-2026-103984 6.5 MEDIUM FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility
CVE-2026-62852 6.5 MEDIUM FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized
CVE-2026-85744 5.4 MEDIUM FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass
CVE-2026-62850 5.3 MEDIUM FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabli
CVE-2026-62855 4.4 MEDIUM FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files
CVE-2026-62851 4.3 MEDIUM FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by

IV. Related Vulnerabilities

Same product: freescout
Same vendor: freescout-help-desk
Same weakness: CWE-79