Unrated severityNVD Advisory· Published May 30, 2025· Updated May 30, 2025
FreeScout Has Business Logic Errors
CVE-2025-48482
Description
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is updated using the fill() method, which processes fields such as channel and channel_id. However, the fill() method is called with all client-provided data, including unexpected values for channel and channel_id, leading to a mass assignment vulnerability. This issue has been patched in version 1.8.180.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/freescout-help-desk/freescout/security/advisories/GHSA-7fjp-538q-9vrfmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.