PT-2025-23247 · Freescout · Freescout

Artem Danilov + 5 · Published 2025-05-13 · Updated 2025-06-04 · CVE-2025-48481

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.180

Description The issue allows an attacker with an unactivated email invitation containing the invite hash to self-activate their account, even if it is blocked or deleted. This is achieved by leveraging the invitation link from the email to gain initial access to the account.

Recommendations For versions prior to 1.8.180, update to version 1.8.180 to resolve the issue. As a temporary workaround, consider restricting access to the invitation link from unactivated email invitations until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-841

Related Identifiers

BDU:2025-06957

CVE-2025-48481

GHSA-JGJ2-X749-5WC7

Affected Products

Freescout

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48481.json · Exploit
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jgj2-x749-5wc7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48481 · Security Note
• https://bdu.fstec.ru/vul/2025-06957 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48481 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1928336540356190712 · Twitter Post
• https://twitter.com/dailycve/status/1930316029567156506 · Twitter Post
• https://t.me/cvetracker/24969 · Telegram Post
• https://t.me/cvenotify/124101 · Telegram Post