CVE-2026-85742 in FreeScout
Summary
by MITRE • 11/06/2026
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.230, a pre-authenticated attacker can place HTML in a failed-login email value that is copied through monitored user activity into a queued SendAlert job. If alert delivery fails, the serialized payload is stored in failed_jobs and the administrator job-details endpoint renders it after a blacklist sanitizer that leaves executable event-handler attributes. When an administrator opens /system/ajax-html/job_details/{id} as a top-level page, the raw fragment lacks the normal layout policy and attacker-controlled JavaScript can perform same-origin administrator actions. Logs Monitoring for users, a failed alert email job, queue failure storage, and top-level administrator interaction are all required; the normal modal path is not affected in the tested configuration. This issue is fixed in version 1.8.230.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
FreeScout serves as a self-hosted help desk solution designed to manage shared mailboxes and customer support tickets, relying on robust internal job queues for asynchronous task execution such as sending email alerts. The vulnerability identified within versions prior to 1.8.230 represents a complex chain of failures involving input validation, serialization handling, and cross-site scripting mechanics that ultimately compromise the administrative interface. This flaw allows a pre-authenticated attacker to execute arbitrary JavaScript code with administrator privileges by exploiting how failed background jobs are stored and subsequently rendered in the web application's user interface.
The attack vector begins when an authenticated user triggers a login failure or similar event that generates an email alert job within the FreeScout queue system. The vulnerability stems from insufficient sanitization of input fields associated with these alerts, specifically allowing HTML content to be embedded directly into the failed-login email value. When this specific queued SendAlert job fails during execution due to configuration issues or delivery errors, it is moved to a database table designated for storing failed jobs, known as failed_jobs. Crucially, the system serializes the payload associated with this failure without adequately stripping dangerous HTML elements. Although a blacklist-based sanitizer attempts to remove malicious content, it contains gaps that permit executable event-handler attributes, such as onerror or onload events, to persist within the stored data structure.
The exploitation phase occurs when an administrator interacts with the application's administrative endpoints. Specifically, if an administrator accesses the job-details endpoint for system AJAX HTML requests at a path like /system/ajax-html/job_details/{id} directly in their browser as a top-level page rather than through the intended modal dialog interface, they trigger the rendering of this unsanitized payload. The critical technical flaw here is that when accessed as a top-level document fragment, the rendered content lacks the normal layout policies and Content Security Policy restrictions typically enforced by the application's main frame or modal context. This absence allows the attacker-controlled JavaScript embedded in the serialized job data to execute immediately within the administrator's session context.
The operational impact of this vulnerability is severe, as it results in a stored cross-site scripting attack that grants full administrative control to an authenticated user with lower privileges. Once executed, the malicious script can perform same-origin actions on behalf of the administrator, including modifying system configurations, accessing sensitive customer data, creating new admin accounts, or exfiltrating session cookies and authentication tokens. This effectively bypasses role-based access controls because the browser treats the injected code as originating from the trusted FreeScout domain, allowing it to interact with all API endpoints and database queries available to that administrator account without triggering additional security warnings.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). More specifically, the mechanism involves stored XSS where malicious scripts are permanently stored within target servers and executed whenever a victim accesses the affected data. In terms of offensive security frameworks, this maps to ATT&CK technique T1059.007, which covers JavaScript execution on web browsers, and potentially T1136 for creating accounts if the script includes logic to escalate privileges further. The reliance on a blacklist sanitizer rather than allow-listing or strict output encoding highlights a common architectural weakness in legacy PHP applications where input validation is attempted but not comprehensively enforced across all serialization paths.
Mitigation strategies must prioritize immediate upgrading to version 1.8.230 or later, as this release addresses the sanitization gaps and ensures that dangerous HTML attributes are properly stripped from job payloads before storage. For organizations unable to patch immediately due to operational constraints, implementing a Web Application Firewall rule to block requests targeting the specific job_details endpoint with suspicious payload patterns can provide temporary relief. Additionally, enforcing strict Content Security Policy headers on all administrative pages, including those accessed via AJAX endpoints, would prevent inline script execution even if malicious content is rendered. Administrators should also review access logs for unusual activity involving the failed_jobs table or unexpected calls to system ajax-html endpoints to detect potential exploitation attempts in real-time.