PT-2025-23179 · Freescout · Freescout

Artem Danilov + 5 · Published 2025-05-13 · Updated 2025-07-02 · CVE-2025-48475

Positive Technologies · (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.180

Description The system does not provide a check on which clients an authorized user can view and edit. As a result, an authorized user without access to existing mailboxes or conversations can view and edit the system's clients. The limitation of client visibility can be implemented by the limit user customer visibility setting, but there is no check for the presence of this setting in certain scenarios.

Recommendations For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider implementing the limit user customer visibility setting to restrict client visibility. Restrict access to client editing features to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-06951

CVE-2025-48475

GHSA-XVCH-F75C-8W8Q

Affected Products

Freescout

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48475.json · Exploit
• https://github.com/freescout-help-desk/freescout/commit/1f154ce039618ed5abd960c97619c23534c0717a · Patch
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-xvch-f75c-8w8q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48475 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48475 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06951 · Security Note
• https://t.me/cvenotify/127409 · Telegram Post
• https://t.me/cvenotify/124017 · Telegram Post
• https://twitter.com/CVEnew/status/1928131541420351520 · Twitter Post
• https://t.me/cvetracker/24915 · Telegram Post