Account Activation Vulnerability in FreeScout Help Desk
CVE-2025-48481

6.1MEDIUM

Key Information:

Vendor

Freescout-help-desk

Status
Freescout
Vendor
CVE Published:
30 May 2025

What is CVE-2025-48481?

FreeScout, a self-hosted help desk software, was found to have a significant security flaw that allows an attacker with an unactivated email invitation link containing an invite_hash to self-activate their account. This issue arises when leveraging the invitation link, which grants access even if the account has been blocked or deleted. The vulnerability has been addressed in version 1.8.180, ensuring enhanced security for users.

Affected Version(s)

freescout < 1.8.180

References

https://github.com/freescout-help-desk/freescout/security...
x_refsource_CONFIRM

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-48481 : Account Activation Vulnerability in FreeScout Help Desk