Log in Start free

Vulnerability · Published May 30, 2025 · Assigned by GitHub_M

CVE-2025-48476FreeScout Has Business Logic Errors

High 7.1

In plain English

A high-severity security flaw in freescout from freescout-help-desk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.6%top 53.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is no check for the absence of the password field in the data coming from the user, which leads to a mass-assignment vulnerability. As a result, a user with the right to edit other users of the system can change their password, and then log in to the system using the set password. This issue has been patched in version 1.8.180.

Affected products (as reported)

VendorProductVersions
freescout-help-desk freescout < 1.8.180

Weakness: CWE-841 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References