CVE-2025-62166CWE-284CWE-639

FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

High · published March 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.5th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-09T19:35Z
EPSS history
Timeline
  • 09 MAR 19:35Z
    FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
    cvelistv5