CVE-2025-48476: FreeScout Auth Bypass Vulnerability

CVE-2025-48476 Overview

CVE-2025-48476 is a mass-assignment vulnerability in FreeScout, an open-source self-hosted help desk and shared mailbox application. The flaw affects all versions prior to 1.8.180. When the application processes user records through the fill() method, it fails to filter the password field from user-supplied data. An authenticated user holding the permission to edit other users can inject a password value into the update request, overwrite the target account's credentials, and authenticate as that account.

Critical Impact
Authenticated low-privilege users with user-edit permissions can reset arbitrary account passwords, including administrator accounts, leading to full account takeover.

Affected Products

FreeScout versions prior to 1.8.180
Self-hosted FreeScout help desk deployments
Shared mailbox instances running affected FreeScout releases

Discovery Timeline

2025-05-30 - CVE-2025-48476 published to NVD
2025-06-04 - Last updated in NVD database

Technical Details for CVE-2025-48476

Vulnerability Analysis

The vulnerability resides in FreeScout's user record handling logic. The application uses the Laravel fill() method to populate model attributes from request input during user creation and modification flows. The implementation does not validate whether the password field is present in the incoming payload, nor does it restrict that field to authorized administrative actions. As a result, the framework's mass-assignment protections are bypassed for the password attribute.

An attacker with the right to edit users submits a modified request containing a password parameter. The fill() call writes the attacker-supplied value to the target user's record, and the model is persisted. The attacker then authenticates using the chosen credentials. The flaw is classified under CWE-841: Improper Enforcement of Behavioral Workflow.

Root Cause

The root cause is missing input filtering before invoking fill(). The user controller passes the raw request payload to the model layer without removing sensitive attributes such as password. FreeScout relies on UI workflow assumptions rather than server-side allowlisting to control which fields a user can modify.

Attack Vector

Exploitation requires network access to the FreeScout instance and an authenticated session with permission to edit user records. The attacker sends a crafted HTTP request to the user update endpoint, appending a password field to the form data. No user interaction from the victim is required, and the attack runs entirely over the standard application interface.

The vulnerability mechanics are documented in the FreeScout GitHub Security Advisory GHSA-7h5m-q39p-h849.

Detection Methods for CVE-2025-48476

Indicators of Compromise

HTTP POST or PUT requests to FreeScout user-edit endpoints containing a password parameter outside of the dedicated password reset workflow.
Successful authentication events for accounts immediately following an edit action performed by a different user.
Unexpected modifications to administrator account records made by non-administrator users.

Detection Strategies

Inspect web server and application logs for user-edit requests that include the password field originating from non-admin sessions.
Correlate user record update events with subsequent login events for the modified account from a new IP address or session.
Run version checks across FreeScout instances to identify hosts running versions earlier than 1.8.180.

Monitoring Recommendations

Enable verbose request logging on the FreeScout reverse proxy and retain logs for forensic review.
Alert on changes to the users database table outside of expected administrative windows.
Track authentication anomalies such as logins from new geographies for privileged accounts.

How to Mitigate CVE-2025-48476

Immediate Actions Required

Upgrade FreeScout to version 1.8.180 or later without delay.
Audit the user table for unexpected password hash changes since the deployment date.
Review the list of accounts granted the user-edit permission and remove any unnecessary grants.
Force a password reset for all users after applying the patch to invalidate any credentials set by an attacker.

Patch Information

The FreeScout maintainers fixed the vulnerability in version 1.8.180 by filtering the password field from input data passed to fill() during user updates. Administrators should apply the upgrade following the project's standard update procedure. Patch details are available in the FreeScout GitHub Security Advisory.

Workarounds

Restrict the user-edit permission to a minimal set of trusted administrative accounts until the patch is applied.
Place the FreeScout administrative interface behind a VPN or IP allowlist to reduce the attack surface.
Enable multi-factor authentication for all accounts so that a stolen password alone is insufficient for access.

bash

# Upgrade FreeScout to the patched release
cd /var/www/freescout
php artisan freescout:after-app-update
git fetch --tags
git checkout 1.8.180
php artisan migrate --force
php artisan freescout:clear-cache