FreshRSS vulnerabilities
We track 12 vulnerabilities in FreshRSS products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on March 9, 2026.
Latest FreshRSS vulnerabilities
- 8.2 High severity
FreshRSS: Improper Authentication
FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password_verify() is currently being called with a constructed string (SHA-256 nonce + part of a bcrypt hash) instead of the raw
- 7.5 High severity
FreshRSS: Improper Access Control
FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of
- 9.8 Critical severity
FreshRSS: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers
- 7.5 High severity
FreshRSS: Allocation of Resources Without Limits or Throttling
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users
- 8.8 High severity
FreshRSS: Improper Limitation of a Pathname to a Restricted Directory
FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user.
- 9.8 Critical severity
FreshRSS: Improper Access Control
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_
- 9.8 Critical severity
FreshRSS is a free, self-hostable RSS aggregator.
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a ne
- 7.5 High severity
FreshRSS: Improper Access Control
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of default admin users, due to lack of access checking in the FreshRSS_Auth::hasAccess() function used by some of the tag/feed related endpoints
- 7.2 High severity
FreshRSS: Improper Control of Generation of Code
FreshRSS is a free, self-hostable RSS aggregator. In versions 1.26.1 and below, an authenticated administrator user can execute arbitrary code on the FreshRSS server by modifying the update URL to one they control, and gain code execution after running an upda
- 7.1 High severity
FreshRSS: Server-Side Request Forgery
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the `Remote-User` header or the `X-WebAuth-User` header by making specially crafted r
- 7.5 High severity
FreshRSS: Insertion of Sensitive Information Into Sent Data
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are installed or if certain
- 7.5 High severity
FreshRSS: Exposure of Sensitive Information to an Unauthorized Actor
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used