Vulnerability · Published Mar 9, 2026 · Assigned by GitHub_M
CVE-2025-62166FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
High 7.5
In plain English
A high-severity improper access control in FreshRSS from FreshRSS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 62.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.
Affected products (as reported)
Weakness: CWE-284, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w743-fg6g-mhwh x_refsource_CONFIRM
- https://github.com/FreshRSS/FreshRSS/pull/8165 x_refsource_MISC
- https://github.com/FreshRSS/FreshRSS/commit/60cf5ea297a17db861e73cd65d7b7862bd6bcc24 x_refsource_MISC
- https://github.com/FreshRSS/FreshRSS/releases/tag/1.28.0 x_refsource_MISC