CVE-2025-54875

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.16.0 through 1.26.3

Description FreshRSS is a free, self-hostable RSS aggregator. An unprivileged attacker can create a new administrator user when registration is enabled. This is achieved through manipulation of a hidden field, new user is admin, used on the user management admin page. The field allows an attacker to set the new user is admin parameter to '1' during registration, granting them administrative privileges.

Recommendations Update to version 1.27.0 or later.