Critical · published September 30, 2025
🚨 An unprivileged attacker can easily create an admin user in FreshRSS just by exploiting a hidden field — it's a massive oversight that can turn your RSS aggregator into a playground for mischief! 🔥 Think of it like a restaurant where anyone can waltz in, grab a staff badge from a hidden drawer, and start serving customers — chaos ensues while the actual managers remain oblivious. 🍽️ With this flaw, an attacker can seize control of your entire FreshRSS installation, creating havoc by managing users, deleting feeds, or even compromising sensitive data. The repercussions could be absolutely devastating, leading to potential data breaches or loss of service that could leave you scrambling for recovery!
Think of it like a restaurant where anyone can waltz in, grab a staff badge from a hidden drawer, and start serving customers — chaos ensues while the actual managers remain oblivious. 🍽️ Versions 1.16.0 to 1.26.3 of FreshRSS allow an attacker to create an admin account using a hidden input field called new_user_is_admin, bypassing normal user privileges entirely. This vulnerability gives access to sensitive functions usually reserved for authorized admins.
With this flaw, an attacker can seize control of your entire FreshRSS installation, creating havoc by managing users, deleting feeds, or even compromising sensitive data. The repercussions could be absolutely devastating, leading to potential data breaches or loss of service that could leave you scrambling for recovery! Update your FreshRSS instance to version 1.27.0 immediately to close this loophole. If you're using versions 1.16.0 through 1.26.3, ensure registration is disabled until you've patched. Regularly review your user management settings to prevent unauthorized access! You've got this! Act fast and secure your FreshRSS, and you'll be a security hero in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| freshrss/freshrss | ≥ 1.16.0, < 1.27.0 | 1.27.0 |