{"id":81919,"date":"2025-10-06T03:32:45","date_gmt":"2025-10-06T03:32:45","guid":{"rendered":""},"modified":"2025-10-28T12:14:02","modified_gmt":"2025-10-28T18:14:02","slug":"cve-2025-54875-critical-security-vulnerability-in-freshrss-affecting-user-management","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-54875-critical-security-vulnerability-in-freshrss-affecting-user-management\/","title":{"rendered":"CVE-2025-54875: Critical Security Vulnerability in FreshRSS Affecting User Management<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The vulnerability, identified as CVE-2025-54875, poses a serious threat to the security of any systems running versions 1.16.0 through 1.26.3 of the FreshRSS software. FreshRSS is a free, self-hosted RSS aggregator popular among developers and tech enthusiasts. The vulnerability allows unprivileged attackers to create a new admin user<\/a> when the registration feature is enabled. This can potentially lead to a system<\/a> compromise or data leakage, thereby jeopardizing the security and integrity of the system and the data it holds. This vulnerability is particularly alarming due<\/a> to its high severity score and the potential for severe impacts if exploited.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-54875
\nSeverity: Critical (CVSS: 9.8)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: System compromise and potential<\/a> for data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

FreshRSS | 1.16.0 through 1.26.3<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability lies in the use of a hidden field in the user<\/a> management admin page of FreshRSS, specifically the “new_user_is_admin” field. An attacker can exploit this vulnerability by embedding a malicious payload in this hidden field while creating a new user<\/a>. This allows the attacker to elevate the new user’s privileges<\/a> to admin level without requiring any existing admin privileges. This can lead to unauthorized system access<\/a> and potential system compromise or data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the vulnerability might be exploited.<\/p>\n

POST \/user\/create HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/x-www-form-urlencoded\nusername=attacker&password=pass123&new_user_is_admin=1<\/code><\/pre>\n
In this example, the “new_user_is_admin” field is set to 1, which the vulnerable versions<\/a> of FreshRSS interpret as making the new user an administrator. The attacker, therefore, gains admin privileges and can perform any actions an administrator can, potentially leading to a system compromise or data<\/a> leakage.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
The best course of action to mitigate this vulnerability is to apply the vendor-supplied patch by upgrading to FreshRSS<\/a> version 1.27.0, which has fixed this issue. For those who cannot immediately apply the patch, a temporary mitigation would be to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to monitor and block potential exploit attempts. It is also recommended to disable user registration if it is not necessary for your application.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The vulnerability, identified as CVE-2025-54875, poses a serious threat to the security of any systems running versions 1.16.0 through 1.26.3 of the FreshRSS software. FreshRSS is a free, self-hosted RSS aggregator popular among developers and tech enthusiasts. The vulnerability allows unprivileged attackers to create a new admin user when the registration feature is enabled. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-81919","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t