{
  "affected": [
    {
      "affectedData": [
        {
          "product": "FreshRSS",
          "vendor": "FreshRSS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.27.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5043EB51-EC2A-4735-A3E0-9E07DA94ECF7",
              "versionEndExcluding": "1.27.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user\u0027s management page after the admin double clicks on a button inside an attacker-controlled website. A successful attack can allow the attacker to promote themselves to \"admin\" and log into other users\u0027 accounts; the attacker has to know the specific instance URL they\u0027re targeting. This issue is fixed in version 1.27.0."
    },
    {
      "lang": "es",
      "value": "FreshRSS es un agregador RSS gratuito y autoalojable. En las versiones 1.26.3 e inferiores, debido a una omisi\u00f3n de la protecci\u00f3n de doble clickjacking (di\u00e1logo de confirmaci\u00f3n), es posible enga\u00f1ar al administrador para que haga clic en el bot\u00f3n \u0027Promover\u0027 en la p\u00e1gina de gesti\u00f3n de otro usuario despu\u00e9s de que el administrador haga doble clic en un bot\u00f3n dentro de un sitio web controlado por un atacante. Un ataque exitoso puede permitir al atacante promoverse a \u0027administrador\u0027 e iniciar sesi\u00f3n en las cuentas de otros usuarios; el atacante debe conocer la URL espec\u00edfica de la instancia a la que se dirige. Este problema est\u00e1 solucionado en la versi\u00f3n 1.27.0."
    }
  ],
  "id": "CVE-2025-59950",
  "lastModified": "2026-10-19T16:10:00.260",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59950",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-09-30T14:19:40.154084Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-30T04:43:45.933",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/FreshRSS/FreshRSS/pull/7771"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}