CVE-2025-48473: FreeScout Information Disclosure Flaw

CVE-2025-48473 Overview

FreeScout is a self-hosted help desk and shared mailbox application. CVE-2025-48473 is a broken access control vulnerability [CWE-863] affecting FreeScout versions prior to 1.8.179. When a user creates a new conversation from an existing message, the application fails to verify that the requester has permission to view the source message. Authenticated users can therefore read arbitrary messages from other mailboxes or restricted conversations by supplying a crafted from_thread_id parameter. The show_only_assigned_conversations restriction is also bypassed. Maintainers patched the flaw in version 1.8.179.

Critical Impact
Any authenticated FreeScout user can retrieve message content from conversations and mailboxes they are not authorized to access, exposing customer support communications across tenant boundaries.

Affected Products

FreeScout (freescout-help-desk/freescout) versions prior to 1.8.179
Self-hosted FreeScout help desk deployments
FreeScout instances with show_only_assigned_conversations enabled

Discovery Timeline

2025-05-29 - CVE-2025-48473 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48473

Vulnerability Analysis

The flaw resides in ConversationsController.php, which handles new conversation creation. When the request includes a from_thread_id parameter, the controller fetches the referenced Thread and reuses its subject, body, and attachments to seed the new conversation. The pre-patch code loads the thread without verifying that the current user can view the parent conversation. Any authenticated user can therefore enumerate thread identifiers and receive their contents through the new conversation form. This bypasses both mailbox-level authorization and the show_only_assigned_conversations visibility restriction that limits agents to conversations assigned to them.

Root Cause

The controller performed only an existence check on the retrieved Thread object. It did not invoke Laravel's authorization gate against the associated conversation. This missing authorization check [CWE-863] allowed cross-mailbox data disclosure through a legitimate feature.

Attack Vector

Exploitation requires an authenticated FreeScout account with low privileges and network access to the web interface. The attacker submits a new-conversation request with a from_thread_id value pointing at a thread in a restricted mailbox or conversation. The server responds with the referenced thread's subject, body, and attachments prefilled into the new conversation view.

php

         $attachments = [];
         if (!empty($request->from_thread_id)) {
             $orig_thread = Thread::find($request->from_thread_id);
-            if ($orig_thread) {
+            if ($orig_thread && auth()->user()->can('view', $orig_thread->conversation)) {
                 $subject = $orig_thread->conversation->subject;
                 $subject = preg_replace('/^Fwd:/i', 'Re: ', $subject);

Source: FreeScout patch commit 2552a2b. The fix adds an auth()->user()->can('view', $orig_thread->conversation) gate check before reusing thread data.

Detection Methods for CVE-2025-48473

Indicators of Compromise

HTTP POST requests to the new-conversation endpoint containing a from_thread_id parameter referencing threads outside the user's assigned mailboxes.
Sequential or enumeration-style from_thread_id values originating from a single user session.
FreeScout application logs showing conversation drafts populated from threads owned by other users or mailboxes.

Detection Strategies

Review web server access logs for repeated from_thread_id values across distinct thread IDs by the same authenticated account.
Correlate FreeScout audit records with mailbox membership to identify users seeding conversations from threads they cannot legitimately view.
Compare deployed FreeScout version against 1.8.179 using file inspection or the admin console to identify vulnerable installations.

Monitoring Recommendations

Enable verbose application logging for conversation creation and reply actions, capturing user ID, mailbox ID, and from_thread_id.
Alert on any user account whose accessed thread IDs span mailboxes outside their assigned scope.
Monitor database query patterns for Thread::find calls followed by conversation reads that cross mailbox boundaries.

How to Mitigate CVE-2025-48473

Immediate Actions Required

Upgrade FreeScout to version 1.8.179 or later on all self-hosted instances.
Audit historical web logs for suspicious from_thread_id usage patterns since the last known-clean deployment.
Rotate credentials and review disclosed conversation content if evidence of exploitation is found.

Patch Information

The fix is available in FreeScout 1.8.179 and documented in GitHub Security Advisory GHSA-3x75-7856-r794. The patch introduces an authorization gate check on the source thread's conversation before it can be used to seed a new conversation. Administrators can verify remediation by inspecting ConversationsController.php for the auth()->user()->can('view', $orig_thread->conversation) guard.

Workarounds

If patching is not immediately possible, restrict access to the FreeScout instance through network controls such as VPN or IP allow-listing.
Reduce the number of low-privilege user accounts and enforce least-privilege mailbox assignments until the upgrade is applied.
Consider temporarily disabling the create-from-thread feature via reverse proxy rules that strip the from_thread_id parameter.

bash

# Upgrade FreeScout via git to the patched release
cd /var/www/freescout
php artisan freescout:module-install --update
git fetch --tags
git checkout 1.8.179
php artisan freescout:after-app-update