Back to Database
Status published
High
CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
Vulnerability Description
FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62166
Credits & Attribution
No credits recorded in the NVD database.
References
More from FreshRSS
View All →CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me token and nonce generation
Low
2.9
CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]
High
8.2
CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After
Medium
4.3
CVE-2025-61586
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Medium
6.9
CVE-2025-59950
FreshRSS: Double clickjacking can lead to privilege escalation
Medium
6.7
Affected Vendor
FreshRSS
View all reports →Affected Software
FreshRSS
Vulnerable Versions:
< 1.28.0
Timeline
Official Publish:
March 9th, 2026
Last Modified:
March 9th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1068
Exploitation for Privilege Escalation
Privilege Escalation
T1078
Valid Accounts
Persistence
T1213
Data from Information Repositories
Collection
T1565.002
Stored Data Manipulation
Impact
T1021
Remote Services
Lateral Movement
T1098
Account Manipulation
Privilege Escalation