CVE-2025-54591 - CVE House
Back to Database
Status published High CVE-2025-54591

FreshRSS: Unauthenticated users can view default user's information

Vulnerability Description

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a defined firstAction() method with an override to make sure that every action requires access. If one doesn't, then every action has to check for access manually, and certain endpoints use neither the firstAction() method, or do they perform a manual access check. This issue is fixed in version 1.27.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54591

Credits & Attribution

No credits recorded in the NVD database.

References

More from FreshRSS

View All →
CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me token and nonce generation
Low 2.9
CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]
High 8.2
CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After
Medium 4.3
CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
High 7.5
CVE-2025-61586
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Medium 6.9

Affected Vendor

Affected Software

FreshRSS
Vulnerable Versions:
< 1.27.0

Timeline

Official Publish: September 29th, 2025
Last Modified: September 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-284

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact