CVE-2025-48478: FreeScout Mass Assignment Vulnerability

CVE-2025-48478 Overview

FreeScout is a free self-hosted help desk and shared mailbox application. Versions prior to 1.8.180 contain a mass assignment vulnerability [CWE-841] in the user creation workflow. Insufficient input validation allows an authenticated attacker to manipulate any field enumerated in the $fillable array of the User model when creating a new user. The maintainers addressed the flaw in version 1.8.180 by restricting which request fields are passed to the User->fill() call.

Critical Impact
An authenticated user with account-creation privileges can assign arbitrary attributes to newly created accounts, enabling privilege escalation and unauthorized modification of sensitive user properties.

Affected Products

FreeScout versions prior to 1.8.180
Self-hosted FreeScout help desk deployments
Shared mailbox instances running vulnerable FreeScout builds

Discovery Timeline

2025-05-30 - CVE-2025-48478 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48478

Vulnerability Analysis

The vulnerability resides in app/Http/Controllers/UsersController.php, where the user creation handler passed the entire HTTP request to Laravel's mass assignment mechanism. The controller invoked $user->fill($request->all()), which populated every attribute listed in the User model's $fillable array from unvalidated client input.

An attacker submitting a crafted POST request to the user creation endpoint could add extra parameters beyond the intended first_name, last_name, and email fields. Those parameters would overwrite properties such as role, status, or other user attributes exposed through $fillable.

The controller does apply a follow-up authorization check via changeRole that resets the role to ROLE_USER when the caller lacks role-change permission. However, this check only covers the role attribute, leaving every other fillable property attacker-controlled.

Root Cause

The root cause is unrestricted mass assignment [CWE-841] driven by trusting the entire request payload. The application never filtered the incoming data before handing it to Eloquent's fill() method, violating the principle of least privilege for object attribute assignment.

Attack Vector

Exploitation requires network access to the FreeScout web interface and an authenticated account with permission to create users. The attacker submits a standard user creation request that includes additional field names matching entries in the User model's $fillable array. The server persists those attacker-supplied values on the new account without validation.

php

// Patch: app/Http/Controllers/UsersController.php
                         ->withInput();
         }
 
+        $data = [
+            'first_name' => $request->first_name,
+            'last_name' => $request->last_name,
+            'email' => $request->email,
+        ];
+
         $user = new User();
-        $user->fill($request->all());
+
+        $user->fill($data);
+
         if (!$auth_user->can('changeRole', $user)) {
             $user->role = User::ROLE_USER;
         }

Source: FreeScout patch commit d2048f5

Detection Methods for CVE-2025-48478

Indicators of Compromise

Unexpected user accounts created with elevated attributes or non-default roles set outside the normal administrative workflow
HTTP POST requests to the FreeScout user creation endpoint containing form fields beyond first_name, last_name, email, and role
Modifications to user records where fillable attributes deviate from values assignable through the standard UI

Detection Strategies

Review the FreeScout application and web server access logs for POST requests to user creation routes that include unusual body parameters
Audit the users database table for accounts whose attributes were populated by non-privileged accounts during creation
Correlate account creation events with the identity of the calling user to flag creations performed by low-privilege accounts

Monitoring Recommendations

Enable verbose request logging on the FreeScout reverse proxy or web server to retain full POST bodies for user creation endpoints
Alert on newly created users whose role or permission fields diverge from organizational baselines
Monitor FreeScout release notes and package registries to detect deployments still running versions below 1.8.180

How to Mitigate CVE-2025-48478

Immediate Actions Required

Upgrade all FreeScout instances to version 1.8.180 or later, which restricts fillable fields during user creation
Audit existing user accounts for unauthorized privilege assignments or unexpected attribute values
Restrict user creation permissions to trusted administrators until the patch is applied

Patch Information

The fix is delivered in FreeScout 1.8.180 via commit d2048f5. The patch replaces $user->fill($request->all()) with an explicit whitelist array containing only first_name, last_name, and email. See the GitHub Security Advisory GHSA-fqjj-79j2-8qx6 and the patch commit for details.

Workarounds

Temporarily revoke user creation permissions from non-administrative roles until the upgrade is deployed
Place a reverse proxy rule in front of the user creation endpoint that strips request parameters other than first_name, last_name, and email
Regularly export and review the users table for unexpected attribute drift while operating unpatched builds

bash

# Verify the installed FreeScout version and upgrade via git
cd /var/www/freescout
git fetch --tags
git checkout 1.8.180
php artisan freescout:after-app-update