CVE-2025-59950

FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.3 and below, due to a bypass of double clickjacking protection (confirmation dialog), it is possible to trick the admin into clicking the Promote button in another user's management page after the admin double clicks on a button inside an attacker-controlled website. A successful attack can allow the attacker to promote themselves to "admin" and log into other users' accounts; the attacker has to know the specific instance URL they're targeting. This issue is fixed in version 1.27.0.

• CWE-1021

• https://github.com/FreshRSS/FreshRSS/pull/7771Patch
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0Release Notes
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3Exploit, Vendor Advisory
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j66v-hvqx-5vh3Exploit, Vendor Advisory

Published

Sep 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59945SysReptor is a fully customizable pentest reporting platform…8.1
• CVE-2025-59946NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. P…7.5
• CVE-2025-59947NanoMQ is a messaging broker/bus for IoT Edge & SDV. Version…9
• CVE-2025-59948FreshRSS is a free, self-hostable RSS aggregator. Versions 1…5.4
• CVE-2025-59949FreshRSS is a free, self-hostable RSS aggregator. Versions p…6.5
• CVE-2025-5995Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29…4.6
• CVE-2025-59951Termix is a web-based server management platform with SSH te…9.1
• CVE-2025-59952MinIO Java SDK is a Simple Storage Service (aka S3) client t…8.7
• CVE-2025-59954Knowage is an open source analytics and business intelligenc…9.8
• CVE-2025-59955Coolify is an open-source and self-hostable tool for managin…5.7
• CVE-2025-59956AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemin…6.5
• CVE-2025-59957An Origin Validation Error vulnerability in an insufficient …7