CVE-2025-48472: FreeScout Auth Bypass Vulnerability

CVE-2025-48472 Overview

FreeScout is a free self-hosted help desk and shared mailbox application. CVE-2025-48472 is a broken access control vulnerability [CWE-863] affecting FreeScout versions prior to 1.8.179. The application fails to verify that a user requesting changes to mailbox notification settings already has access to that mailbox. The notification toggle logic explicitly grants access to the mailbox as a side effect of enabling or disabling notifications. An unauthenticated network-accessible attacker can leverage this flaw to gain unauthorized mailbox access and view confidential support correspondence. The issue was patched in FreeScout version 1.8.179.

Critical Impact
Unauthorized users can gain access to mailboxes they do not own by toggling notification settings, exposing confidential ticket data and customer communications.

Affected Products

FreeScout versions prior to 1.8.179
Self-hosted FreeScout help desk deployments
All installations exposing the notification toggle endpoint

Discovery Timeline

2025-05-29 - CVE-2025-48472 published to the National Vulnerability Database
2025-06-10 - Last updated in NVD database

Technical Details for CVE-2025-48472

Vulnerability Analysis

The vulnerability resides in the FreeScout mailbox notification handler. The code path responsible for enabling or disabling per-mailbox notifications omits an authorization check that confirms whether the requesting user is already a member of the target mailbox. Because the notification toggle is exposed over the network and requires no privileges, an attacker can issue a request specifying any mailbox identifier. The handler accepts the request and updates the notification state without validating mailbox membership.

Root Cause

The root cause is missing authorization (broken access control) in the mailbox notification toggle. FreeScout intentionally implements logic that grants a user access to a mailbox once notifications for it are enabled or disabled. This conflates a notification preference change with an access grant. Without a precondition check confirming existing mailbox access, the notification endpoint behaves as an unauthenticated access-provisioning function. The fix in version 1.8.179 introduces a validation step that rejects notification changes for mailboxes the user does not already belong to. See the GitHub Security Advisory GHSA-f62r-8354-8pqg for advisory details.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker enumerates mailbox identifiers and submits a notification toggle request for each one. The vulnerable handler persists the change and adds the attacker to the mailbox access list. Subsequent authenticated requests to mailbox endpoints return ticket content, attachments, and customer data. The vendor patch commit 01c91d2086ddd56778698e557138a178b2f59916 shows the corrected authorization logic.

No verified public proof-of-concept code is available. Refer to the upstream advisory and patch commit for technical specifics of the corrected access check.

Detection Methods for CVE-2025-48472

Indicators of Compromise

Unexpected entries in the mailbox_user association table linking accounts to mailboxes they should not access
HTTP POST or AJAX requests to the mailbox notification toggle endpoint referencing mailbox IDs the requesting user previously had no relationship with
Sudden expansion of a low-privilege user's visible mailboxes within the FreeScout web console
Audit log gaps or absent administrative actions preceding new mailbox membership records

Detection Strategies

Query the FreeScout database for recently added mailbox memberships and correlate against administrative provisioning records
Review web server access logs for repeated POST requests to notification-related routes targeting multiple distinct mailbox identifiers from the same source
Compare current mailbox access lists against a known-good baseline taken before exposure to vulnerable versions
Inspect HTTP request patterns for sequential or enumerated mailbox ID values in notification endpoint calls

Monitoring Recommendations

Enable verbose application logging on the FreeScout server to capture every notification setting change with the acting user identifier
Forward FreeScout application logs and reverse proxy logs to a centralized log platform for retention and correlation
Alert on bursts of notification toggle requests from a single session or IP address
Periodically export the mailbox-to-user mapping and diff against the prior export to surface unauthorized additions

How to Mitigate CVE-2025-48472

Immediate Actions Required

Upgrade FreeScout to version 1.8.179 or later without delay
Audit the current mailbox_user mapping table and remove any unauthorized associations created while vulnerable code was deployed
Rotate API keys and force password resets for accounts that may have obtained illegitimate mailbox access
Restrict network exposure of the FreeScout web interface to trusted networks or behind a VPN until patching is complete

Patch Information

The maintainers fixed CVE-2025-48472 in FreeScout version 1.8.179. The corrective change is published in commit 01c91d2086ddd56778698e557138a178b2f59916 and described in the GHSA-f62r-8354-8pqg security advisory. Administrators should pull the tagged release, run database migrations, and clear application caches as part of the upgrade.

Workarounds

No official workaround exists short of upgrading to 1.8.179
Place FreeScout behind an authenticated reverse proxy or web application firewall rule that blocks unauthenticated access to notification-related routes as a temporary measure
Disable user self-registration and tightly restrict who can authenticate to the FreeScout instance until the patch is applied

bash

# Upgrade FreeScout to the patched release
cd /var/www/freescout
sudo -u www-data git fetch --tags
sudo -u www-data git checkout 1.8.179
sudo -u www-data php artisan freescout:after-app-update
sudo -u www-data php artisan config:cache
sudo systemctl restart php-fpm nginx