CVE-2025-54591 FreshRSS: Unauthenticated users can view default user's information
Unauthenticated attackers can view sensitive feed and tag information of default admin users due to missing access checks in specific endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-54591?
CVE-2025-54591 is a high-severity missing authorization vulnerability in FreshRSS, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a defined firstAction() method with an override to make sure that every action requires access. If one doesn't, then every action has to check for access manually, and certain endpoints use neither the firstAction() method, or do they perform a manual access check. This issue is fixed in version 1.27.0.
Weakness: CWE-284
Which versions are affected by CVE-2025-54591?
It affects 1 product.
Products include Freshrss Freshrss.
How do I fix CVE-2025-54591?
No fix has been published for CVE-2025-54591 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-54591 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54591 exists.
Other vulnerabilities in FreshRSS
- CVE-2025-54875 FreshRSS: Unauthorized creation of admin user when registration is enabled
- CVE-2025-54592 FreshRSS has Incomplete Session Termination on Logout
- CVE-2025-62166 FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens
- CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()
- CVE-2025-54593 FreshRSS is vulnerable to RCE attacks by authenticated admin
Sources
Also known as GHSA-jf4v-f8p2-8xvq.