FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. U…

Published:

8 maart 2026 om 23:00:00

Alert date:

9 maart 2026 om 21:02:12

Source:

nvd.nist.gov

Web Technologies, Identity & Access

FreshRSS, a free self-hostable RSS aggregator, contains an authentication bypass vulnerability in versions prior to 1.28.0. The bug exists in the auth logic related to master authentication tokens, allowing the restriction to be bypassed. This vulnerability enables unauthorized access to private user feeds when anonymous viewing is enabled, when normally only the default user's feed should be viewable. The issue has been patched in version 1.28.0.

Technical details

Mitigation steps:

Affected products:

FreshRSS