CVE-2025-48473: FreeScout Vulnerable to Insufficient Authorization
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, there is no check to ensure that the user has the ability to view this message. Thus, the user can view arbitrary messages from other mailboxes or from other conversations to which they do not have access (access restriction to conversations is implemented by the showonlyassignedconversations setting, which is also not checked). This issue has been patched in version 1.8.179.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48473?
CVE-2025-48473 is a critical vulnerability as it allows unauthorized access to arbitrary messages within FreeScout.
How do I fix CVE-2025-48473?
To fix CVE-2025-48473, update FreeScout to version 1.8.179 or later, where the vulnerability has been addressed.
Who is affected by CVE-2025-48473?
Any user running FreeScout versions prior to 1.8.179 is affected by CVE-2025-48473.
What impact does CVE-2025-48473 have on FreeScout users?
CVE-2025-48473 can lead to unauthorized message viewing, potentially exposing sensitive information to unprivileged users.
Is there a workaround for CVE-2025-48473 if I cannot upgrade?
There is no official workaround for CVE-2025-48473, so upgrading to the latest version is strongly recommended.