CVE-2025-48475 FreeScout Vulnerable to Insufficient Authorization

Medium 5.3 Published 29 May 2025 Updated 29 May 2025

Authorized users can view and edit client data without proper access checks, bypassing visibility restrictions in FreeScout help desk.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-48475?

CVE-2025-48475 is a medium-severity missing authorization vulnerability in freescout-help-desk freescout, published on 29 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the System does not provide a check on which "clients" of the System an authorized user can view and edit, and which ones they cannot. As a result, an authorized user who does not have access to any of the existing mailboxes, as well as to any of the existing conversations, has the ability to view and edit the System's clients. The limitation of client visibility can be implemented by the limit_user_customer_visibility setting, however, in the specified scenarios, there is no check for the presence of this setting. This issue has been patched in version 1.8.180.

Weakness: CWE-863

Which versions are affected by CVE-2025-48475?

It affects 1 product.

Products include Freescout Freescout.

How do I fix CVE-2025-48475?

No fix has been published for CVE-2025-48475 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-48475 being exploited?

There is no known exploitation of CVE-2025-48475 in the wild and no public exploit code.

Sources

Also known as GHSA-xvch-f75c-8w8q.