PT-2025-23174 · Freescout · Freescout

Artem Danilov + 5 · Published 2025-05-13 · Updated 2025-05-29 · CVE-2025-48472

Positive Technologies · (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.179

Description The issue concerns the lack of a check to ensure users can only disable notifications for mailboxes they already have access to. The code allows users to gain access to a mailbox by disabling or enabling notifications for it, even if they did not have access initially.

Recommendations For versions prior to 1.8.179, update to version 1.8.179 to resolve the issue. As a temporary workaround, consider restricting access to the notification settings for mailboxes to minimize the risk of unauthorized access.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-06948

CVE-2025-48472

GHSA-F62R-8354-8PQG

Affected Products

Freescout

References · 8

• 🔥 https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-f62r-8354-8pqg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48472.json · Exploit
• https://github.com/freescout-help-desk/freescout/commit/01c91d2086ddd56778698e557138a178b2f59916 · Patch
• https://bdu.fstec.ru/vul/2025-06948 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48472 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48472 · Vendor Advisory
• https://t.me/cvetracker/24909 · Telegram Post
• https://twitter.com/CVEnew/status/1928113052723073453 · Twitter Post