CVE-2025-48880: FreeScout has Race Condition When Deleting Users

Severity: medium (CVSS 6.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-30 · updated 2026-06-17
Weakness: CWE-362

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.181, when an administrative account is a deleting a user, there is the the possibility of a race condition occurring. This issue has been patched in version 1.8.181.

Affected products

freescout-help-desk freescout: before 1.8.181 — fixed in 1.8.181

How to fix

Upgrade to a fixed version: freescout-help-desk freescout 1.8.181. Check the vendor advisory for mitigations.

References

https://github.com/freescout-help-desk/freescout/commit/3f5bb2841f7de3303bc3cb00930a28440754d122
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9vf2-mg4j-4v7f

Get alerted when CVE-2025-48880 or the next vulnerability affects your stack