HTML Injection Vulnerability in FreeScout Help Desk Software
CVE-2026-85742

7.5HIGH

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
6 November 2026

What is CVE-2026-85742?

A vulnerability in FreeScout allows a pre-authenticated attacker to inject HTML into failed-login email values. This HTML payload can be stored in failed_jobs if alert delivery fails, and may be rendered by the administrator when accessing job details through a specific endpoint. The lack of proper sanitization enables execution of attacker-controlled JavaScript, potentially allowing unauthorized actions as an administrator. Proper monitoring and prompt updates to version 1.8.230 are essential to mitigate this risk.

Affected Version(s)

freescout < 1.8.230

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM
https://github.com/freescout-help-desk/freescout/commit/3...
x_refsource_MISC
https://github.com/freescout-help-desk/freescout/releases...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.