A pre‑authenticated attacker can inject HTML into a failed‑login email field. This payload is copied into a queued alert job, and when that job fails it is stored in the failed_jobs table. The administrator job‑details endpoint renders the stored payload after a sanitizer that removes many tags but retains event‑handler attributes. When an administrator opens the job details page as a top‑level document, the malicious fragment contains a normal layout policy, allowing the embedded JavaScript to run using the administrator’s credentials. This can be used to perform arbitrary same‑origin actions as an administrator, effectively granting the attacker administrative control within the application.

FreeScout self‑hosted help desk, versions prior to 1.8.230. The vulnerability was fixed in release 1.8.230; later releases are not affected.

The vulnerability has a CVSS score of 7.5. EPSS is not available and the issue is not listed in CISA’s KEV catalog. Exploitation requires three conditions: a failed alert email that ends up in failed_jobs, the job to be rendered via the job_details endpoint, and the victim to open that endpoint as a top‑level page. Given these prerequisites, the vulnerability is likely exploitable in environments that use the default job queue and user activity monitoring but it is not trivially leveraged from an arbitrary remote location.