CVE-2025-62166: FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62166?
CVE-2025-62166 is classified as a medium severity vulnerability due to its potential for unauthorized data access.
How do I fix CVE-2025-62166?
To mitigate CVE-2025-62166, upgrade FreshRSS to version 1.28.0 or later.
What types of attacks does CVE-2025-62166 enable?
CVE-2025-62166 allows attackers to exploit IDOR to view feeds of any user and potentially leak sensitive tokens.
Who is affected by CVE-2025-62166?
Users of FreshRSS versions prior to 1.28.0 are vulnerable to CVE-2025-62166.
What is the nature of the flaw in CVE-2025-62166?
CVE-2025-62166 involves a bug in the authentication logic that bypasses restrictions on viewing user feeds.