CVE-2025-62166 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. U…
High CVSS: 7.5

CVE-2025-62166

FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.
Vendor
Freshrss
Product
Freshrss
CWE
CWE-284
Yayın Tarihi
2026-03-09 20:16:01
Güncelleme
2026-03-13 19:39:08
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-284 Freshrss HIGH Freshrss 2026

Referanslar

https://github.com/FreshRSS/FreshRSS/commit/60cf5ea297a17db861e73cd65d7b7862bd6bcc24 https://github.com/FreshRSS/FreshRSS/pull/8165 https://github.com/FreshRSS/FreshRSS/releases/tag/1.28.0 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w743-fg6g-mhwh