CVE-2025-54875

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-54875", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-07-31T17:23:33.474Z", "datePublished": "2025-09-29T21:29:50.136Z", "dateUpdated": "2025-09-30T14:55:56.331Z"}, "containers": {"cna": {"title": "FreshRSS: Unauthorized creation of admin user when registration is enabled", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq"}, {"name": "https://github.com/FreshRSS/FreshRSS/pull/7783", "tags": ["x_refsource_MISC"], "url": "https://github.com/FreshRSS/FreshRSS/pull/7783"}, {"name": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0"}], "affected": [{"vendor": "FreshRSS", "product": "FreshRSS", "versions": [{"version": ">= 1.16.0, < 1.27.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-29T21:29:50.136Z"}, "descriptions": [{"lang": "en", "value": "FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This is fixed in version 1.27.0."}], "source": {"advisory": "GHSA-h625-ghr3-jppq", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T14:55:26.557118Z", "id": "CVE-2025-54875", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T14:55:56.331Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-54875", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-30T14:55:26.557118Z"}}}], "references": [{"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T14:55:52.783Z"}}], "cna": {"title": "FreshRSS: Unauthorized creation of admin user when registration is enabled", "source": {"advisory": "GHSA-h625-ghr3-jppq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "FreshRSS", "product": "FreshRSS", "versions": [{"status": "affected", "version": ">= 1.16.0, < 1.27.0"}]}], "references": [{"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq", "name": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/FreshRSS/FreshRSS/pull/7783", "name": "https://github.com/FreshRSS/FreshRSS/pull/7783", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0", "name": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This is fixed in version 1.27.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-29T21:29:50.136Z"}}}, "cveMetadata": {"cveId": "CVE-2025-54875", "state": "PUBLISHED", "dateUpdated": "2025-09-30T14:55:56.331Z", "dateReserved": "2025-07-31T17:23:33.474Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-29T21:29:50.136Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "FreshRSS", "vendor": "FreshRSS", "versions": [{"status": "affected", "version": ">= 1.16.0, < 1.27.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*", "matchCriteriaId": "E822C429-121B-48A7-952C-549734842FE6", "versionEndExcluding": "1.27.0", "versionStartIncluding": "1.16.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FreshRSS is a free, self-hostable RSS aggregator. In versions 1.16.0 and above through 1.26.3, an unprivileged attacker can create a new admin user when registration is enabled through the use of a hidden field used only in the user management admin page, new_user_is_admin. This is fixed in version 1.27.0."}, {"lang": "es", "value": "FreshRSS es un agregador RSS gratuito y autoalojable. En las versiones 1.16.0 y superiores hasta la 1.26.3, un atacante sin privilegios puede crear un nuevo usuario administrador cuando el registro est\u00e1 habilitado mediante el uso de un campo oculto utilizado solo en la p\u00e1gina de administraci\u00f3n de gesti\u00f3n de usuarios, new_user_is_admin. Esto se corrige en la versi\u00f3n 1.27.0."}], "id": "CVE-2025-54875", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54875", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-30T14:55:26.557118Z", "version": "2.0.3"}}]}, "published": "2025-09-29T22:15:36.307", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/FreshRSS/FreshRSS/pull/7783"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/FreshRSS/FreshRSS/releases/tag/1.27.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory", "Vendor Advisory"], "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory", "Vendor Advisory"], "url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-h625-ghr3-jppq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-09-30T08:47:36.225340+00:00", "updated": "2025-09-30T08:47:36.225403+00:00", "vendors": ["freshrss", "freshrss$PRODUCT$freshrss"]}