CVE-2025-62166

Katalog CVE

CVSS 7.5 · High EPSS 0,39%

Kerentanan Improper Access Control pada freshrss. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w743-fg6g-mhwh exploit · patch · advisory vendor
• https://github.com/FreshRSS/FreshRSS/commit/60cf5ea297a17db861e73cd65d7b7862bd6bcc24 patch
• https://github.com/FreshRSS/FreshRSS/pull/8165 issue tracking · patch
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.28.0 product · release notes