Medium severity · published May 29, 2025
CVE-2025-48473
FreeScout Vulnerable to Insufficient Authorization
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, there is no check to ensure that the user has the ability to view this message. Thus, the user can view arbitrary messages from other mailboxes or from other conversations to which they do not have access (access restriction to conversations is implemented by the show_only_assigned_conversations setting, which is also not checked). This issue has been patched in version 1.8.179.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
freescout · freescout-help-desk
< 1.8.179 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-48473
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-48473
Patch
https://github.com/freescout-help-desk/freescout/commit/2552a2b84248824b73c35b2699aa86da644eea1a
Exploit
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-3x75-7856-r794
More from freescout
9.8
CVE-2026-40498
FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
9.8
CVE-2026-27637
FreeScout's Predictable Authentication Token Enables Account Takeover
9.8
CVE-2025-48481
FreeScout Has Business Logic Errors
9.8
CVE-2025-48471
FreeScout Vulnerable to Arbitrary File Upload
9.4
CVE-2026-53595
FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL