CVE-2025-48880: Freescout Race Condition Vulnerability

CVE-2025-48880 Overview

CVE-2025-48880 is a race condition vulnerability in FreeScout, a self-hosted help desk and shared mailbox application. The flaw exists in the user deletion workflow of the administrative interface prior to version 1.8.181. When an administrator initiates deletion of a user account, concurrent requests can create a race condition [CWE-362] that bypasses safety checks. The maintainers patched the issue in FreeScout 1.8.181.

Critical Impact
An authenticated administrator can trigger a race condition during user deletion, potentially removing the sole administrator account or otherwise corrupting user state.

Affected Products

FreeScout versions prior to 1.8.181
Self-hosted FreeScout help desk deployments
Shared mailbox instances using vulnerable FreeScout releases

Discovery Timeline

2025-05-30 - CVE-2025-48880 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48880

Vulnerability Analysis

The vulnerability resides in the user deletion handler within app/Http/Controllers/UsersController.php. FreeScout enforced a rule that the last remaining administrator account could not be deleted. The check counted administrator records and blocked the deletion if fewer than two administrators existed. However, the count and the subsequent deletion were not executed as an atomic operation.

An administrator issuing two concurrent delete requests against two different administrator accounts could pass the check in both threads before either deletion committed. Both requests then proceeded to delete their targets, leaving the system without an administrator. The flaw also allowed an administrator to delete their own account under the same race window.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) defect. The controller queried the administrator count and then performed the deletion in separate steps without transactional locking. Concurrent HTTP requests observed the same pre-deletion state and each concluded the operation was safe.

Attack Vector

Exploitation requires an authenticated account with administrative privileges. The attacker sends two or more parallel deletion requests targeting administrator user IDs. Successful exploitation can remove all administrators from the instance, disrupting help desk operations and locking legitimate operators out of the console.

php

// Patch excerpt from app/Http/Controllers/UsersController.php
                    $response['msg'] = __('User not found');
                } elseif (!$auth_user->can('delete', $user)) {
                    $response['msg'] = __('Not enough permissions');
+                } elseif ($auth_user->id == $user->id) {
+                    // Do not allow admin delete himself.
+                    $response['msg'] = __('Not enough permissions');
                }

                // Check if the user is the only one admin
-                if (!$response['msg'] && $user->isAdmin()) {
-                    $admins_count = User::where('role', User::ROLE_ADMIN)->count();
-                    if ($admins_count < 2) {
-                        $response['msg'] = __('Administrator can not be deleted');
-                    }
-                }
+                // - not needed as only admin can delete users and
+                // current admin can not delete himself.

Source: FreeScout patch commit 3f5bb28

Detection Methods for CVE-2025-48880

Indicators of Compromise

Multiple near-simultaneous DELETE or POST requests to the FreeScout user management endpoint targeting different administrator user IDs.
Audit log entries showing successful deletion of the last administrator account or deletion of the currently authenticated administrator.
Unexpected absence of administrator accounts in the FreeScout users table.

Detection Strategies

Review FreeScout application logs for burst patterns of user deletion requests originating from the same authenticated session within milliseconds.
Correlate web server access logs against administrator account changes recorded in the database to identify race-based deletions.
Alert on any administrative action that reduces the administrator user count to zero.

Monitoring Recommendations

Enable verbose audit logging for FreeScout administrative endpoints, including source IP, user ID, and target user ID.
Forward FreeScout and reverse proxy logs to a centralized SIEM for concurrency analysis and long-term retention.
Monitor authentication failures following user deletions, which may indicate an operator locked out of the console.

How to Mitigate CVE-2025-48880

Immediate Actions Required

Upgrade FreeScout to version 1.8.181 or later without delay.
Audit the administrator user list and current session logs for signs of unauthorized deletions.
Restrict administrative access to trusted operators and enforce strong authentication controls.

Patch Information

The fix is available in FreeScout 1.8.181. The patch, released in commit 3f5bb28, prevents an administrator from deleting their own account and removes the now-unnecessary last-admin count check, since only administrators can delete users and they cannot delete themselves. Details are published in the GitHub Security Advisory GHSA-9vf2-mg4j-4v7f.

Workarounds

Limit the number of administrator accounts and closely control who receives the role until the upgrade is applied.
Place the FreeScout admin interface behind a reverse proxy or WAF that can rate-limit concurrent requests to the user deletion endpoint.
Take regular database backups so administrator accounts can be restored quickly if the race condition is triggered.

bash

# Example: verify installed FreeScout version and upgrade
cd /var/www/freescout
php artisan freescout:version
git fetch --tags && git checkout 1.8.181
php artisan freescout:after-app-update