PT-2025-39920 · Freshrss · Freshrss

Inverle · Published 2025-09-29 · Updated 2025-09-30 · CVE-2025-59950

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.26.3 and below

Description FreshRSS is susceptible to a double clickjacking protection bypass. An attacker can trick an administrator into promoting themselves to "admin" and logging into other users' accounts. This is achieved by exploiting a flaw in the confirmation dialog, requiring knowledge of the specific instance URL. A successful attack requires the administrator to double-click on a button within an attacker-controlled website.

Recommendations Update to version 1.27.0 or later.

Exploit

Fix

LPE

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2025-59950

GHSA-J66V-HVQX-5VH3

Affected Products

Freshrss

References · 10

• 🔥 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59950.json · Exploit
• https://github.com/FreshRSS/FreshRSS/pull/7771 · Patch
• https://osv.dev/vulnerability/CVE-2025-59950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59950 · Security Note
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0 · Note
• https://t.me/CVEtracker/33682 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1972902720265715754 · Twitter Post
• https://twitter.com/CVEnew/status/1972808142074384713 · Twitter Post
• https://t.me/cveNotify/136899 · Telegram Post