CVE-2025-48476: FreeScout Has Business Logic Errors
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is no check for the absence of the password field in the data coming from the user, which leads to a mass-assignment vulnerability. As a result, a user with the right to edit other users of the system can change their password, and then log in to the system using the set password. This issue has been patched in version 1.8.180.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48476?
CVE-2025-48476 has been categorized with a high severity due to its potential for mass assignment vulnerability in FreeScout.
How do I fix CVE-2025-48476?
To fix CVE-2025-48476, upgrade to FreeScout version 1.8.180 or later, which includes the necessary security checks.
What software is affected by CVE-2025-48476?
CVE-2025-48476 affects FreeScout versions prior to 1.8.180.
What kind of vulnerability is CVE-2025-48476?
CVE-2025-48476 is a mass assignment vulnerability that allows an attacker to potentially manipulate user records.
What is the impact of CVE-2025-48476?
The impact of CVE-2025-48476 may allow unauthorized changes to user data, including passwords, resulting in compromised accounts.