Overview
The vulnerability, identified as CVE-2025-54875, poses a serious threat to the security of any systems running versions 1.16.0 through 1.26.3 of the FreshRSS software. FreshRSS is a free, self-hosted RSS aggregator popular among developers and tech enthusiasts. The vulnerability allows unprivileged attackers to create a new admin user when the registration feature is enabled. This can potentially lead to a system compromise or data leakage, thereby jeopardizing the security and integrity of the system and the data it holds. This vulnerability is particularly alarming due to its high severity score and the potential for severe impacts if exploited.
Vulnerability Summary
CVE ID: CVE-2025-54875
Severity: Critical (CVSS: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise and potential for data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
FreshRSS | 1.16.0 through 1.26.3
How the Exploit Works
The vulnerability lies in the use of a hidden field in the user management admin page of FreshRSS, specifically the “new_user_is_admin” field. An attacker can exploit this vulnerability by embedding a malicious payload in this hidden field while creating a new user. This allows the attacker to elevate the new user’s privileges to admin level without requiring any existing admin privileges. This can lead to unauthorized system access and potential system compromise or data leakage.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited.
POST /user/create HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
username=attacker&password=pass123&new_user_is_admin=1In this example, the “new_user_is_admin” field is set to 1, which the vulnerable versions of FreshRSS interpret as making the new user an administrator. The attacker, therefore, gains admin privileges and can perform any actions an administrator can, potentially leading to a system compromise or data leakage.
Mitigation Guidance
The best course of action to mitigate this vulnerability is to apply the vendor-supplied patch by upgrading to FreshRSS version 1.27.0, which has fixed this issue. For those who cannot immediately apply the patch, a temporary mitigation would be to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to monitor and block potential exploit attempts. It is also recommended to disable user registration if it is not necessary for your application.
