CVE-2025-62166

Published: Mar 9, 2026Modified: Mar 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.

Affected (1)

Products: Freshrss: Freshrss

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Freshrss Freshrss	Before 1.28.0

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

https://github.com/FreshRSS/FreshRSS/commit/60cf5ea297a17db861e73cd65d7b7862bd6bcc24

Source: security-advisories@github.com

Patch

https://github.com/FreshRSS/FreshRSS/pull/8165

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/FreshRSS/FreshRSS/releases/tag/1.28.0

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w743-fg6g-mhwh

Source: security-advisories@github.com

ExploitPatchVendor Advisory

Timeline

No history available yet.