Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2025-48474: FreeScout lets users view any conversation
CVE-2025-48474 · published 1 year ago
Summary
The free self‑hosted help desk FreeScout (versions before 1.8.180) does not correctly verify who may see each support ticket. A user can assign themselves to any conversation they can reach and then read its contents, even if they should not have access. Upgrade FreeScout to version 1.8.180 or later to fix the issue.
What to do
- Update freescout freescout to version 1.8.180 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| freescout | freescout |
< 1.8.180 cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:* |
Original advisory text
FreeScout Vulnerable to Insufficient Authorization
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations. Users with show_only_assigned_conversations enabled can assign themselves to an arbitrary conversation from the mailbox to which they have access, thereby bypassing the restriction on viewing conversations. This issue has been patched in version 1.8.180.
References
- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9wc4-v... Vendor Advisory
- https://github.com/freescout-help-desk/freescout/commit/87cdb65d6b632b5292bcac2d... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48474... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-48474 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-863Incorrect Authorization
Timeline
Published29 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta