CVE-2025-59950 - CVE House
Back to Database
Status published Medium CVE-2025-59950

FreshRSS: Double clickjacking can lead to privilege escalation

Vulnerability Description

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double clicks on a button inside an attacker-controlled website. A successful attack can allow the attacker to promote themselves to "admin" and log into other users' accounts; the attacker has to know the specific instance URL they're targeting. This issue is fixed in version 1.27.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59950

Credits & Attribution

No credits recorded in the NVD database.

References

More from FreshRSS

View All →
CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me token and nonce generation
Low 2.9
CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]
High 8.2
CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After
Medium 4.3
CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
High 7.5
CVE-2025-61586
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Medium 6.9

Affected Vendor

Affected Software

FreshRSS
Vulnerable Versions:
< 1.27.0

Timeline

Official Publish: September 29th, 2025
Last Modified: September 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-1021

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.