PT-2026-24101 · Freshrss · Freshrss

CVE-2025-62166 · Published 2026-03-09 · Updated 2026-03-10

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreshRSS versions prior to 1.28.0

Description FreshRSS, a free, self-hostable RSS aggregator, contains an issue in its authentication logic related to master authentication tokens. This flaw bypasses a restriction intended to limit anonymous viewing to only the default user’s feed, potentially exposing feeds of other users that should be private.

Recommendations Update to version 1.28.0 or later.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2025-62166

GHSA-W743-FG6G-MHWH

Affected Products

Freshrss

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62166.json · Exploit
• https://github.com/FreshRSS/FreshRSS/commit/60cf5ea297a17db861e73cd65d7b7862bd6bcc24 · Patch
• https://github.com/FreshRSS/FreshRSS/pull/8165 · Patch
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w743-fg6g-mhwh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62166 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62166 · Vendor Advisory
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.28.0 · Note
• https://twitter.com/CVEnew/status/2031122520976335099 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2031164318629187748 · Twitter Post