CVE-2025-48481
CRITICALDescription
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted, by leveraging the invitation link from the email to gain initial access to the account. This issue has been patched in version 1.8.180.
Is your site exposed to CVE-2025-48481?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| freescout | freescout |
References
Frequently Asked Questions
What is CVE-2025-48481? +
How severe is CVE-2025-48481? +
What products are affected by CVE-2025-48481? +
How do I check if I'm vulnerable to CVE-2025-48481? +
Related Vulnerabilities
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical …
Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification …
Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful …
Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status …
Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful …
A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick …
