CVE-2025-59950

{
  "id": "CVE-2025-59950",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-30T04:43:45.933",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double clicks on a button inside an attacker-controlled website. A successful attack can allow the attacker to promote themselves to \"admin\" and log into other users' accounts; the attacker has to know the specific instance URL they're targeting. This issue is fixed in version 1.27.0."
    },
    {
      "lang": "es",
      "value": "FreshRSS es un agregador RSS gratuito y autoalojable. En las versiones 1.26.3 e inferiores, debido a una omisión de la protección de doble clickjacking (diálogo de confirmación), es posible engañar al administrador para que haga clic en el botón 'Promover' en la página de gestión de otro usuario después de que el administrador haga doble clic en un botón dentro de un sitio web controlado por un atacante. Un ataque exitoso puede permitir al atacante promoverse a 'administrador' e iniciar sesión en las cuentas de otros usuarios; el atacante debe conocer la URL específica de la instancia a la que se dirige. Este problema está solucionado en la versión 1.27.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "FreshRSS",
          "product": "FreshRSS",
          "versions": [
            {
              "version": "< 1.27.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.5
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-30T14:19:40.154084Z",
          "id": "CVE-2025-59950",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.27.0",
              "matchCriteriaId": "5043EB51-EC2A-4735-A3E0-9E07DA94ECF7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/FreshRSS/FreshRSS/pull/7771",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}