FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This is fixed in version 1.27.0.
References
| Link | Resource |
|---|---|
| https://github.com/FreshRSS/FreshRSS/pull/7783 | Patch |
| https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0 | Release Notes |
| https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq | Exploit Third Party Advisory Vendor Advisory |
| https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq | Exploit Third Party Advisory Vendor Advisory |
Configurations
History
03 Oct 2025, 15:59
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| References | () https://github.com/FreshRSS/FreshRSS/pull/7783 - Patch | |
| References | () https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0 - Release Notes | |
| References | () https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq - Exploit, Third Party Advisory, Vendor Advisory | |
| CPE | cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:* | |
| First Time |
Freshrss freshrss
Freshrss |
30 Sep 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq - |
29 Sep 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-29 22:15
Updated : 2025-10-03 15:59
NVD link : CVE-2025-54875
Mitre link : CVE-2025-54875
CVE.ORG link : CVE-2025-54875
JSON object : View
Products Affected
freshrss
- freshrss
CWE