CVE-2025-54875

{
  "id": "CVE-2025-54875",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-29T22:15:36.307",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This is fixed in version 1.27.0."
    },
    {
      "lang": "es",
      "value": "FreshRSS es un agregador RSS gratuito y autoalojable. En las versiones 1.16.0 y superiores hasta la 1.26.3, un atacante sin privilegios puede crear un nuevo usuario administrador cuando el registro está habilitado mediante el uso de un campo oculto utilizado solo en la página de administración de gestión de usuarios, new_user_is_admin. Esto se corrige en la versión 1.27.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "FreshRSS",
          "product": "FreshRSS",
          "versions": [
            {
              "version": ">= 1.16.0, < 1.27.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-30T14:55:26.557118Z",
          "id": "CVE-2025-54875",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "1.16.0",
              "versionEndExcluding": "1.27.0",
              "matchCriteriaId": "E822C429-121B-48A7-952C-549734842FE6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/FreshRSS/FreshRSS/pull/7783",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "Vendor Advisory"
      ]
    }
  ]
}