Back to Database
Status published
Medium
CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After
Vulnerability Description
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68148
Credits & Attribution
No credits recorded in the NVD database.
References
More from FreshRSS
View All →CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me token and nonce generation
Low
2.9
CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]
High
8.2
CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
High
7.5
CVE-2025-61586
FreshRSS is vulnerable to directory enumeration by setting path in its theme field
Medium
6.9
CVE-2025-59950
FreshRSS: Double clickjacking can lead to privilege escalation
Medium
6.7
Affected Vendor
FreshRSS
View all reports →Affected Software
FreshRSS
Vulnerable Versions:
>= 1.27.0, < 1.28.0
Timeline
Official Publish:
December 26th, 2025
Last Modified:
December 29th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L