What’s Vulnerable › Vulnerabilities

CVE-2025-48478: FreeScout Has Business Logic Errors

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-30 · updated 2026-06-17
• Weakness: CWE-841

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, insufficient input validation during user creation has resulted in a mass assignment vulnerability, allowing an attacker to manipulate all fields of the object, which are enumerated in the $fillable array (the User object), when creating a new user. This issue has been patched in version 1.8.180.

Affected products

• freescout-help-desk freescout: before 1.8.180 — fixed in 1.8.180

How to fix

Upgrade to a fixed version: freescout-help-desk freescout 1.8.180. Check the vendor advisory for mitigations.

References

• https://github.com/freescout-help-desk/freescout/commit/d2048f59a899dbcfc9a71bb98549ead81cdb62a5
• https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-fqjj-79j2-8qx6

Get alerted when CVE-2025-48478 or the next vulnerability affects your stack