CVE-2025-48474: FreeScout Vulnerable to Insufficient Authorization
Description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations. Users with show_only_assigned_conversations enabled can assign themselves to an arbitrary conversation from the mailbox to which they have access, thereby bypassing the restriction on viewing conversations. This issue has been patched in version 1.8.180.
Classification
CVE ID: CVE-2025-48474
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.3
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Problem Types
CWE-863: Incorrect AuthorizationAffected Products
Vendor: freescout-help-desk
Product: freescout
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 12.61% (scored less or equal to compared to others)
EPSS Date: 2025-06-17 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-48474https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9wc4-vchw-mr3m
https://github.com/freescout-help-desk/freescout/commit/87cdb65d6b632b5292bcac2d7a209f6e36ae51d7