PT-2025-39904 · Freshrss · Freshrss

Inverle · Published 2025-09-29 · Updated 2025-09-29 · CVE-2025-54875

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.16.0 through 1.26.3

Description FreshRSS is a free, self-hostable RSS aggregator. An unprivileged attacker can create a new administrator user when registration is enabled. This is achieved through manipulation of a hidden field, new user is admin, used on the user management admin page. The field allows an attacker to set the new user is admin parameter to '1' during registration, granting them administrative privileges.

Recommendations Update to version 1.27.0 or later.

Exploit

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-54875

GHSA-H625-GHR3-JPPQ

Affected Products

Freshrss

References · 10

• 🔥 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54875.json · Exploit
• https://github.com/FreshRSS/FreshRSS/pull/7783 · Patch
• https://osv.dev/vulnerability/CVE-2025-54875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54875 · Security Note
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0 · Note
• https://twitter.com/0dayPublishing/status/1972778092885070083 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1972805447384990051 · Twitter Post
• https://twitter.com/CVEnew/status/1972781091498119418 · Twitter Post
• https://t.me/CVEtracker/33669 · Telegram Post