CVE-2026-85742

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.

• CWE-79

• https://github.com/freescout-help-desk/freescout/commit/3f508d41a01bd754ef78a7fab38743f141bd1714
• https://github.com/freescout-help-desk/freescout/releases/tag/1.8.230
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2g42-f97q-973x

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85734LightRAG provides simple and fast retrieval-augmented genera…9.1
• CVE-2026-85736Chartbrew is an open-source web application that can connect…8.1
• CVE-2026-85737Velociraptor is a tool for collecting host-based state infor…6.5
• CVE-2026-85738TREK is a collaborative travel planner. Prior to 3.4.0, the …6.3
• CVE-2026-8574Use after free in Core in Google Chrome on Windows prior to …8.3
• CVE-2026-85740LightRAG provides simple and fast retrieval-augmented genera…7.1
• CVE-2026-85743FreeScout is a self-hosted help desk and shared mailbox. Pri…8.2
• CVE-2026-85744FreeScout is a self-hosted help desk and shared mailbox. Pri…5.4
• CVE-2026-85745MariaDB server is a community developed fork of MySQL server…4.3
• CVE-2026-85746MariaDB server is a community developed fork of MySQL server…9.9
• CVE-2026-85747Distribution is a toolkit to pack, ship, store, and deliver …6.8
• CVE-2026-85748MariaDB server is a community developed fork of MySQL server…9.9