CVE-2025-48477: FreeScout Has Business Logic Errors
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application's logic requires the user to perform a correct sequence of actions to implement a functional capability, but the application allows access to the functional capability without correctly completing one or more actions in the sequence. The leaves the attributes of Mailbox object able to be changed by the fill method. This issue has been patched in version 1.8.180.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48477?
CVE-2025-48477 has been assessed with a high severity rating due to improper access control.
How do I fix CVE-2025-48477?
To fix CVE-2025-48477, upgrade to FreeScout version 1.8.180 or later.
What versions of FreeScout are affected by CVE-2025-48477?
FreeScout versions prior to 1.8.180 are affected by CVE-2025-48477.
What does CVE-2025-48477 exploit?
CVE-2025-48477 exploits the application's logic regarding access control, allowing unauthorized actions.
Is there a workaround for CVE-2025-48477?
There is no recommended workaround for CVE-2025-48477, updating to the latest version is the only solution.