CVE-2025-59950— FreshRSS: Double clickjacking can lead to privilege escalation
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-59950
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreshRSS: Double clickjacking can lead to privilege escalation
Source: NVD (National Vulnerability Database)
Vulnerability Description
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double clicks on a button inside an attacker-controlled website. A successful attack can allow the attacker to promote themselves to "admin" and log into other users' accounts; the attacker has to know the specific instance URL they're targeting. This issue is fixed in version 1.27.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
不当限制渲染UI层或帧
Source: NVD (National Vulnerability Database)
Vulnerability Title
FreshRSS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreshRSS是FreshRSS开源的一个免费的、可自行托管的 RSS 聚合器。 FreshRSS 1.26.3及之前版本存在安全漏洞，该漏洞源于绕过双重点击劫持保护，可能导致权限提升和账户接管。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-59950
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-59950
请登录查看更多情报信息。
Same Patch Batch · FreshRSS · 2025-09-29 · 7 CVEs total
| CVE-2025-54875 | 9.8 CRITICAL | FreshRSS: Unauthorized creation of admin user when registration is enabled |
| CVE-2025-54591 | 7.5 HIGH | FreshRSS: Unauthenticated users can view default user's information |
| CVE-2025-59948 | 6.7 MEDIUM | FreshRSS is vulnerable to XSS due to lack of CSP on HTML query page |
| CVE-2025-54592 | FreshRSS has Incomplete Session Termination on Logout | |
| CVE-2025-57769 | FressRSS: Clickjacking can lead to XSS and/or privilege escalation | |
| CVE-2025-61586 | FreshRSS is vulnerable to directory enumeration by setting path in its theme field |
IV. Related Vulnerabilities
Same product: FreshRSS
- CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcryp - CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any u - CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying - CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me to - CVE-2025-59949
FreshRSS has Logout CSRF that Leads to DoS via <track src>
Same vendor: FreshRSS
- CVE-2025-68402
FreshRSS has an authentication bypass due to truncated bcryp - CVE-2025-62166
FreshRSS has an IDOR which allows for viewing feeds of any u - CVE-2025-68148
FreshRSS globally denies access to feed via proxy modifying - CVE-2025-68932
FreshRSS has weak cryptographic randomness in remember-me to - CVE-2025-59949
FreshRSS has Logout CSRF that Leads to DoS via <track src>
Same weakness: CWE-1021
- CVE-2026-3254
Improper Restriction of Rendered UI Layers or Frames in GitL - CVE-2026-2378
Address bar spoofing risk in ArcSearch on Android - CVE-2025-62328
HCL Nomad server on Domino is affected by a missing default - CVE-2025-58405
Lack of protection mechanisms against Clickjacking attacks - CVE-2026-27511
Tenda F3 Clickjacking in Web Management Interface
V. Comments for CVE-2025-59950
No comments yet