CVE-2025-48472: freescout

csirt@kutim:~/threat-intel/cve/CVE-2025-48472

CVSS 8.1 · High EPSS 0,40%

Kerentanan Incorrect Authorization pada freescout. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications for the mailbox to which they already have access. Moreover, the code explicitly implements functionality that if the user does not have access to the mailbox, then after disabling (enabling) notifications for this mailbox, the user will gain access to it. This issue has been patched in version 1.8.179.

Rincian

Terbit di NVD: 29 Mei 2025
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-863: Incorrect Authorization
EPSS (30 hari): 0,40% peluang dieksploitasi; lebih tinggi dari 32,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
freescout	freescout	Semua versi sebelum 1.8.179

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-f62r-8354-8pqg exploit · advisory vendor
https://github.com/freescout-help-desk/freescout/commit/01c91d2086ddd56778698e557138a178b2f59916 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.