CVE-2025-48474: FreeScout Auth Bypass Vulnerability

CVE-2025-48474 Overview

CVE-2025-48474 is an authorization bypass vulnerability in FreeScout, a self-hosted help desk and shared mailbox application. The flaw resides in how the application validates user access rights for conversations. Users restricted by the show_only_assigned_conversations setting can assign themselves to any conversation in a mailbox they can access, bypassing the intended viewing restriction. The vulnerability is classified as [CWE-863] Incorrect Authorization. FreeScout patched the issue in version 1.8.180.

Critical Impact
Authenticated users with restricted conversation access can read arbitrary conversations within their accessible mailboxes by self-assigning, exposing potentially sensitive customer support data.

Affected Products

FreeScout versions prior to 1.8.180
Self-hosted FreeScout deployments using the show_only_assigned_conversations restriction
All mailboxes containing conversations not directly assigned to a restricted user

Discovery Timeline

2025-05-29 - CVE-2025-48474 published to NVD
2025-07-02 - Last updated in NVD database

Technical Details for CVE-2025-48474

Vulnerability Analysis

FreeScout supports a per-user setting named show_only_assigned_conversations that restricts an operator to viewing only the conversations explicitly assigned to them within a mailbox. This control is meant to enforce least-privilege access in shared support environments where multiple agents handle different customers.

The vulnerability stems from the application checking access rights at the wrong control point. The conversation assignment endpoint validates that the user has access to the parent mailbox, but it does not enforce that the user already has permission to view the specific conversation. As a result, a restricted user can invoke the self-assignment action against any conversation ID within an accessible mailbox. Once assigned, the conversation falls under the user's own queue and becomes readable.

This is a classic broken access control flaw mapped to [CWE-863]. The authorization decision relies on the post-action state rather than the pre-action permission, allowing the user to manipulate state to gain access. Exploitation requires only authenticated, low-privilege access over the network and no user interaction.

Root Cause

The root cause is missing authorization on the conversation assignment handler. The handler trusts that mailbox-level access is sufficient and does not re-evaluate the show_only_assigned_conversations constraint before mutating the assignment field. The upstream patch in commit 87cdb65d6b632b5292bcac2d7a209f6e36ae51d7 adds the missing permission check.

Attack Vector

An authenticated user with the show_only_assigned_conversations flag enabled issues a self-assignment request against a conversation identifier they would otherwise be restricted from viewing. The request succeeds because mailbox membership is the only check performed. The conversation then appears in the attacker's assigned list, exposing its contents, history, and attachments. See the GitHub Security Advisory GHSA-9wc4-vchw-mr3m for additional context.

Detection Methods for CVE-2025-48474

Indicators of Compromise

Unexpected self-assignment events in FreeScout audit logs where the assigning user matches the new assignee.
Spikes in conversation assignment activity from accounts configured with show_only_assigned_conversations.
Restricted users accessing conversations they were not previously assigned to, particularly across multiple customers in a short window.

Detection Strategies

Review FreeScout database conversations and audit history tables for assignment changes initiated by users with the restricted flag enabled.
Correlate web server access logs for POST requests to conversation assignment endpoints originating from low-privilege accounts.
Baseline normal assignment volume per user and alert on anomalies, since legitimate restricted users rarely self-assign in bulk.

Monitoring Recommendations

Ingest FreeScout application and web logs into a centralized log platform and apply detection rules for unusual self-assignment patterns.
Monitor for access to conversations involving sensitive customers by accounts that previously had no relationship with those conversations.
Alert on any restricted account viewing more unique conversations per day than its historical baseline.

How to Mitigate CVE-2025-48474

Immediate Actions Required

Upgrade FreeScout to version 1.8.180 or later, which contains the official authorization fix.
Audit historical assignment activity for restricted users to identify any prior unauthorized access.
Review user role assignments and remove the show_only_assigned_conversations privilege from accounts that do not require it.

Patch Information

The fix is delivered in FreeScout 1.8.180 via commit 87cdb65d6b632b5292bcac2d7a209f6e36ae51d7, which adds the missing permission check before allowing self-assignment. Refer to the FreeScout patch commit and the GitHub Security Advisory GHSA-9wc4-vchw-mr3m for full details.

Workarounds

Temporarily revoke mailbox access from users who rely on show_only_assigned_conversations until the patch is applied.
Restrict network access to the FreeScout instance so that only trusted operators can reach the application.
Increase audit log retention and review assignment events daily until the upgrade is completed.

bash

# Upgrade FreeScout to the patched release
cd /var/www/freescout
php artisan freescout:after-app-update
git fetch --tags
git checkout 1.8.180
php artisan freescout:clear-cache