CVE-2025-48481

FreeScout Has Business Logic Errors

State: Published
Severity: 6.1 Medium
Published: May 30, 2025
Updated: May 30, 2025
Reserved: May 22, 2025

Description

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted, by leveraging the invitation link from the email to gain initial access to the account. This issue has been patched in version 1.8.180.

Scores

CVSS	Score	Vector	Source
4.0	6.1 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-841 Improper Enforcement of Behavioral Workflow

Affected Products

Product	Versions
freescoutfreescout-help-desk	< 1.8.180Affected

References

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jgj2-x749-5wc7

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.