CVE-2025-59950
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
FreshRSS versions 1.26.3 and below have a bypass of double clickjacking protection, allowing an attacker to trick the admin into clicking the Promote button on another user's management page after the admin double-clicks a button on an attacker-controlled website.
Risk Assessment
An attacker can promote themselves to admin and log into other users' accounts if they know the target instance URL.
Recommendation
Update FreshRSS to version 1.27.0 or later, which fixes this vulnerability.
Other vulnerabilities in FreshRSS
See all- CVE-2025-68402High
FreshRSS, a free self-hostable RSS aggregator, contains a vulnerability in development versions (from 57e1a37 to 00f2f04) where the nonce length was changed from 40 to 64 characters. password_verify() is called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw user password. Due to bcrypt's 72-byte input truncation, password verification may succeed even when the user enters an incorrect password.
- CVE-2025-68932Critical
FreshRSS prior to version 1.28.0 uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking.
- CVE-2025-54875Critical
FreshRSS versions 1.16.0 through 1.26.3 allow an unprivileged attacker to create an admin user when registration is enabled, by abusing the hidden new_user_is_admin field used only in the admin user management page. This is fixed in version 1.27.0.
- CVE-2025-54592Critical
FreshRSS versions 1.26.3 and below do not properly terminate the session during logout. After logout, the session cookie remains active and unchanged, which can lead to session hijacking and fixation vulnerabilities. This is fixed in version 1.27.0.
- CVE-2025-68148Medium
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, an attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on a given instance, making it unusable for the majority of users. This issue has been patched in version 1.28.0.
- CVE-2025-59949Medium
FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.
- CVE-2025-58173High
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue.
- CVE-2025-61586Medium
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting a path in the theme field, allowing attackers to gain additional information about the server.
- CVE-2025-59948Medium
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, allowing XSS payload execution if a page renders feed entries without CSP. The Allow API access setting must be enabled beforehand. Account takeover is possible via password change, UserJS persistence, autofill password theft, or phishing page display. If the victim is an administrator, the attacker can perform administrative actions. Fixed in 1.27.0.
- CVE-2025-57769Medium
FreshRSS versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0.
Original NVD description (English source)
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double clicks on a button inside an attacker-controlled website. A successful attack can allow the attacker to promote themselves to "admin" and log into other users' accounts; the attacker has to know the specific instance URL they're targeting. This issue is fixed in version 1.27.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS