CVE-2025-54591: FreshRSS: Unauthenticated users can view default user's information
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSSAuth::hasAccess() function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a defined firstAction() method with an override to make sure that every action requires access. If one doesn't, then every action has to check for access manually, and certain endpoints use neither the firstAction() method, or do they perform a manual access check. This issue is fixed in version 1.27.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54591?
CVE-2025-54591 is considered a medium severity vulnerability due to the information exposure affecting default admin users.
How do I fix CVE-2025-54591?
To fix CVE-2025-54591, upgrade FreshRSS to version 1.27.0 or later where the vulnerability is patched.
What impact does CVE-2025-54591 have on FreshRSS installations?
CVE-2025-54591 allows unauthorized access to feed and tag information of default admin users, potentially compromising sensitive data.
Which versions of FreshRSS are affected by CVE-2025-54591?
CVE-2025-54591 affects FreshRSS versions 1.26.3 and below.
Is there a workaround for CVE-2025-54591?
Currently, there is no documented workaround for CVE-2025-54591, making upgrading the only recommended solution.