CVE-2025-48482CWE-841

FreeScout Has Business Logic Errors

Medium · published May 30, 2025

CVSS v4.0
5.3
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is updated using the fill() method, which processes fields such as channel and channel_id. However, the fill() method is called with all client-provided data, including unexpected values for channel and channel_id, leading to a mass assignment vulnerability. This issue has been patched in version 1.8.180.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00345 · 26.8th percentile
Weakness
CWE-841 · Improper Enforcement of Behavioral Workflow
Published
2025-05-30T04:35Z
EPSS history
Timeline
  • 30 MAY 04:35Z
    FreeScout Has Business Logic Errors
    cvelistv5