CVE-2025-48472: FreeScout Vulnerable to Insufficient Authorization
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications for the mailbox to which they already have access. Moreover, the code explicitly implements functionality that if the user does not have access to the mailbox, then after disabling (enabling) notifications for this mailbox, the user will gain access to it. This issue has been patched in version 1.8.179.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48472?
The severity of CVE-2025-48472 is considered medium due to the potential for unauthorized access to mailbox notification settings.
How do I fix CVE-2025-48472?
To fix CVE-2025-48472, upgrade FreeScout to version 1.8.179 or later.
What type of vulnerability is CVE-2025-48472?
CVE-2025-48472 is an access control vulnerability affecting notification settings in FreeScout.
Which versions of FreeScout are affected by CVE-2025-48472?
Versions of FreeScout prior to 1.8.179 are affected by CVE-2025-48472.
What can happen if CVE-2025-48472 is not mitigated?
If CVE-2025-48472 is not mitigated, users may unintentionally alter notification settings for mailboxes they should not manage.