CVE-2025-62166

FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

7.5 High

FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This vulnerability is fixed in 1.28.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.43%Up 0.4 points since Mar 10, 2026

What each source reports

CVE List Score used 7.5

FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

Record: CVE-2025-62166
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-284, CWE-639
Updated: 2026-11-02

EUVDEUVD-2025-208442 7.5

Record: EUVD-2025-208442
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

NVD 7.5

Record: CVE-2025-62166
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-284, CWE-639
Updated: 2026-11-02

OSV 7.5

FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokens

Record: CVE-2025-62166
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-284, CWE-639
Updated: 2026-11-02

Affected products

freshrss

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-62166 is a high vulnerability (CVSS 7.5) in Freshrss, published March 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. No source names a fixed version.