PT-2025-23178 · Freescout · Freescout

Artem Danilov + 5 · Published 2025-05-13 · Updated 2025-07-02 · CVE-2025-48474

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.180

Description The application incorrectly checks user access rights for conversations. Users with show only assigned conversations enabled can assign themselves to an arbitrary conversation from the mailbox to which they have access, thereby bypassing the restriction on viewing conversations.

Recommendations For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider disabling the feature that allows users to assign themselves to conversations until the update is applied. Restrict access to the mailbox to minimize the risk of exploitation.

Exploit

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-06950

CVE-2025-48474

GHSA-9WC4-VCHW-MR3M

Affected Products

Freescout

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48474.json · Exploit
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9wc4-vchw-mr3m · Vendor Advisory
• https://github.com/freescout-help-desk/freescout/commit/87cdb65d6b632b5292bcac2d7a209f6e36ae51d7 · Patch
• https://osv.dev/vulnerability/CVE-2025-48474 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06950 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48474 · Security Note
• https://t.me/cvetracker/24911 · Telegram Post
• https://t.me/cvenotify/127408 · Telegram Post
• https://twitter.com/CVEnew/status/1928123954876522922 · Twitter Post