PT-2025-23179 · Freescout · Freescout

Artem Danilov + 5 · Published 2025-05-13 · Updated 2025-07-02 · CVE-2025-48475

Positive Technologies · (AI Summary)

CVSS v3.1

8.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.180

Description The system does not provide a check on which clients an authorized user can view and edit. As a result, an authorized user without access to existing mailboxes or conversations can view and edit the system's clients. The limitation of client visibility can be implemented by the

limit user customer visibility

setting, but there is no check for the presence of this setting in certain scenarios.

Recommendations For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider implementing the

limit user customer visibility

setting to restrict client visibility. Restrict access to client editing features to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-06951

CVE-2025-48475

GHSA-XVCH-F75C-8W8Q

Affected Products

Freescout

References · 9

• https://github.com/freescout-help-desk/freescout/commit/1f154ce039618ed5abd960c97619c23534c0717a · Patch
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-xvch-f75c-8w8q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48475 · Security Note
• https://bdu.fstec.ru/vul/2025-06951 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48475 · Vendor Advisory
• https://t.me/cvenotify/127409 · Telegram Post
• https://twitter.com/CVEnew/status/1928131541420351520 · Twitter Post
• https://t.me/cvetracker/24915 · Telegram Post
• https://t.me/cvenotify/124017 · Telegram Post