CVE-2025-54591

{
  "id": "CVE-2025-54591",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-29T21:15:37.990",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoints. FreshRSS controllers usually have a defined firstAction() method with an override to make sure that every action requires access. If one doesn't, then every action has to check for access manually, and certain endpoints use neither the firstAction() method, or do they perform a manual access check. This issue is fixed in version 1.27.0."
    },
    {
      "lang": "es",
      "value": "FreshRSS es un agregador RSS gratuito y autoalojable. Las versiones 1.26.3 e inferiores exponen información sobre las fuentes y etiquetas de los usuarios administradores predeterminados, debido a la falta de verificación de acceso en la función FreshRSS_Auth::hasAccess() utilizada por algunos de los puntos finales relacionados con etiquetas/fuentes. Los controladores de FreshRSS suelen tener un método firstAction() definido con una anulación para asegurar que cada acción requiera acceso. Si uno no lo tiene, entonces cada acción tiene que verificar el acceso manualmente, y ciertos puntos finales no utilizan el método firstAction() ni realizan una verificación de acceso manual. Este problema está solucionado en la versión 1.27.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "FreshRSS",
          "product": "FreshRSS",
          "versions": [
            {
              "version": "< 1.27.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-30T15:02:24.413662Z",
          "id": "CVE-2025-54591",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.27.0",
              "matchCriteriaId": "5043EB51-EC2A-4735-A3E0-9E07DA94ECF7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/FreshRSS/FreshRSS/pull/7768",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jf4v-f8p2-8xvq",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-jf4v-f8p2-8xvq",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}