What’s Vulnerable › Vulnerabilities

CVE-2025-59950: FreshRSS: Double clickjacking can lead to privilege escalation

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-30 · updated 2026-10-19
• Weakness: CWE-1021

Description

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double clicks on a button inside an attacker-controlled website. A successful attack can allow the attacker to promote themselves to "admin" and log into other users' accounts; the attacker has to know the specific instance URL they're targeting. This issue is fixed in version 1.27.0.

Affected products

• FreshRSS: before 1.27.0 — fixed in 1.27.0

How to fix

Upgrade to a fixed version: FreshRSS 1.27.0. Check the vendor advisory for mitigations.

References

• https://github.com/FreshRSS/FreshRSS/pull/7771
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3

Get alerted when CVE-2025-59950 or the next vulnerability affects your stack