CVE-2025-54592

Vulnerability overview: FreshRSS

CVE-2025-54592 FreshRSS has Incomplete Session Termination on Logout

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This...

CVE-2025-54591

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSSAuth::hasAccess function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a...

CVE-2025-54591

Summary (CVE-2025-54591, FreshRSS) FreshRSS versions 1.26.3 and earlier expose information about feeds and tags belonging to default admin users due to insufficient access checks in the FreshRSS_Auth::hasAccess() function used by some tag/feed endpoints. Some controllers either lack a defined fir...

CVE-2025-54591 FreshRSS: Unauthenticated users can view default user's information

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSSAuth::hasAccess function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a...

CVE-2025-54591 FreshRSS: Unauthenticated users can view default user's information

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSSAuth::hasAccess function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a...

CVE-2025-54591 FreshRSS: Unauthenticated users can view default user's information

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSSAuth::hasAccess function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a...

PT-2025-39920

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.26.3 and below Description FreshRSS is susceptible to a double clickjacking protection bypass. An attacker can trick an administrator into promoting themselves to "admin" and logging into other users' accounts. This is...

FreshRSS security vulnerability

FreshRSS is a free, self-hosted RSS aggregator from FreshRSS Open Source. A security vulnerability exists in FreshRSS 1.26.3 and earlier versions, which stems from a specially crafted page that may trick a user into executing arbitrary JS code or elevating a user's privileges, potentially leading...

CVE-2025-59948: Improper Neutralization of Input During Web Page Generation

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to ...

PT-2025-39901

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.26.3 and below Description FreshRSS, a self-hostable RSS aggregator, discloses information about feeds and tags belonging to default admin users. This is due to missing access controls within the FreshRSS Auth::hasAccess...

PT-2025-39904

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.16.0 through 1.26.3 Description FreshRSS is a free, self-hostable RSS aggregator. An unprivileged attacker can create a new administrator user when registration is enabled. This is achieved through manipulation of a hidden...

PT-2025-39903

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.26.3 and below Description FreshRSS does not properly end a user session when they log out. The session cookie remains active and can be reused by an attacker to start a new session, potentially leading to session hijacking...

PT-2025-39905

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.26.3 and below Description FreshRSS is a free, self-hostable RSS aggregator susceptible to a flaw where a crafted page can mislead a user into executing arbitrary JavaScript code or elevating privileges within FreshRSS. Thi...

FreshRSS cross-site scripting vulnerabilities

FreshRSS is a free, self-hosted RSS aggregator from FreshRSS Open Source. A cross-site scripting vulnerability exists in FreshRSS versions 1.26.3 and earlier, which stems from not cleaning certain event handler attributes in the feed content and could lead to a cross-site scripting attack...

FreshRSS Access Control Vulnerability

FreshRSS is a free, self-hosted RSS aggregator from FreshRSS Open Source. An access control error vulnerability exists in FreshRSS 1.26.3 and earlier versions, which stems from a lack of access checking in the FreshRSSAuth::hasAccess function, which could lead to information disclosure...

CVE-2025-54591: Improper Access Control

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSSAuth::hasAccess function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a...

PT-2025-39919

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.26.3 and below Description FreshRSS is susceptible to directory enumeration. By manipulating the theme field with a specific path, an attacker can determine the existence of directories on the server, potentially gaining...

CVE-2025-54592: Insufficient Session Expiration

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This...

CVE-2025-54875: Improper Access Control

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, newuserisadmin. This is fixed in version...