VULNERABILITY INTELLIGENCE

CVE-2025-62166

CVSS score7.5 HIGH

EPSS probability0.40%

CISA KEVNot currently listed

Published2026-03-09

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.

Weakness classification

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Issue Tracking, Patch
security-advisories@github.com — Product, Release Notes
security-advisories@github.com — Exploit, Patch, Vendor Advisory