CVE-2025-54875

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This is fixed in version 1.27.0.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/FreshRSS/FreshRSS/pull/7783	Patch
https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0	Release Notes
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq	Exploit Third Party Advisory Vendor Advisory
https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq	Exploit Third Party Advisory Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) FreshRSS es un agregador RSS gratuito y autoalojable. En las versiones 1.16.0 y superiores hasta la 1.26.3, un atacante sin privilegios puede crear un nuevo usuario administrador cuando el registro está habilitado mediante el uso de un campo oculto utilizado solo en la página de administración de gestión de usuarios, new_user_is_admin. Esto se corrige en la versión 1.27.0.

Information

Published : 2025-09-29 22:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-54875

Mitre link : CVE-2025-54875

CVE.ORG link : CVE-2025-54875

JSON object : View

Products Affected

freshrss

freshrss

CWE

CWE-284

Improper Access Control

NVD-CWE-noinfo

{"id": "CVE-2025-54875", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54875", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-30T14:55:26.557118Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FreshRSS", "product": "FreshRSS", "versions": [{"status": "affected", "version": ">= 1.16.0, < 1.27.0"}]}]}], "published": "2025-09-29T22:15:36.307", "references": [{"url": "https://github.com/FreshRSS/FreshRSS/pull/7783", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq", "tags": ["Exploit", "Third Party Advisory", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq", "tags": ["Exploit", "Third Party Advisory", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This is fixed in version 1.27.0."}, {"lang": "es", "value": "FreshRSS es un agregador RSS gratuito y autoalojable. En las versiones 1.16.0 y superiores hasta la 1.26.3, un atacante sin privilegios puede crear un nuevo usuario administrador cuando el registro est\u00e1 habilitado mediante el uso de un campo oculto utilizado solo en la p\u00e1gina de administraci\u00f3n de gesti\u00f3n de usuarios, new_user_is_admin. Esto se corrige en la versi\u00f3n 1.27.0."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E822C429-121B-48A7-952C-549734842FE6", "versionEndExcluding": "1.27.0", "versionStartIncluding": "1.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}