CVE-2025-62166: 
NixOS vulnerability analysis and mitigation

CVE-2025-62166 is an authorization bypass (IDOR) vulnerability in FreshRSS, a free self-hostable RSS aggregator, that allows unauthenticated attackers to view the private RSS feeds of any user on an instance where anonymous viewing is enabled. The flaw affects all FreshRSS versions up to and including 1.27.1, and was fixed in version 1.28.0 released on December 24, 2025. The vulnerability was reported by researcher Inverle and publicly disclosed via a GitHub Security Advisory on March 8, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is improper access control (CWE-284) combined with authorization bypass through a user-controlled key (CWE-639). The vulnerable logic resides in FreshRSS_Auth::removeAccess() in app/Models/Auth.php, which is called on every unauthenticated request. When a non-empty token parameter is present in the request, the function sets the active username to the attacker-supplied user parameter without validating whether the token actually belongs to that user — any non-empty string suffices as the token value. This causes the application to load and serve the target user's feed data in all actions that permit anonymous access (e.g., index, normal, reader, global, rss, opml). Additionally, real authentication tokens were leaked in the HTML source to anonymous viewers, enabling persistent access even after patching (GitHub Advisory, Patch Commit).

An unauthenticated remote attacker can read all RSS feed data belonging to any user on a vulnerable FreshRSS instance, provided anonymous viewing is enabled. This includes feed contents, feed URLs, and — critically — any credentials (usernames, passwords, cookies) stored within feed configurations, which are exposed via the OPML export endpoint. Additionally, real master authentication tokens can be harvested from the HTML source during anonymous viewing and used for persistent access even after the vulnerability is patched or anonymous viewing is disabled. There is no integrity or availability impact, but the confidentiality breach can be severe for multi-user instances (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, with explicit URLs and numbered reproduction steps demonstrating successful exploitation against live instances (HTTP 200 responses from unauthorized access). The exploit requires no authentication, no special privileges, and no user interaction — only that the target instance has anonymous viewing enabled. The EPSS score is approximately 0.077%, reflecting low current exploitation probability. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory, Feedly).

1. Reconnaissance: Identify publicly accessible FreshRSS instances (versions ≤ 1.27.1) using search engines or tools like Shodan. Confirm anonymous viewing is enabled by visiting the instance's main page without logging in.
2. Enumerate usernames: Attempt to identify valid usernames on the instance (e.g., via error responses, public profile pages, or common defaults like admin).
3. Craft malicious request: Send an HTTP GET request to the target instance with an attacker-controlled user parameter and any non-empty token value, e.g.:

   GET /i/?c=index&a=normal&user=someuser&token=x

4. Access private feed data: A HTTP 200 response confirms the bypass is successful. The response renders the target user's full feed view, including all subscribed feeds and their contents.
5. Exfiltrate OPML data: Request the OPML export to obtain all feed URLs and any stored credentials:

   GET /i/?c=index&a=opml&user=someuser&token=x

6. Harvest authentication tokens: Inspect the HTML source of the normal view response for the target user's real master authentication token, which is embedded in RSS/OPML link elements. This token can be used for persistent feed access even after the vulnerability is patched (GitHub Advisory).

• Network: Unusual HTTP GET requests to /i/?c=index&a=normal, /i/?c=index&a=rss, /i/?c=index&a=opml, or /i/?c=index&a=reader containing both a user= parameter (set to a non-default username) and a token= parameter with an arbitrary or short value (e.g., token=x), originating from unauthenticated sessions.
• Logs: Web server access logs showing repeated 200-status responses to the above endpoints from unauthenticated clients; multiple requests cycling through different user= values from the same source IP.
• Logs: Requests to the OPML export endpoint (a=opml) from unauthenticated sessions, which may indicate credential harvesting attempts.
• Application Behavior: Presence of master authentication tokens in HTML source served to anonymous (unauthenticated) sessions in versions prior to 1.28.0 (GitHub Advisory).

Upgrade FreshRSS to version 1.28.0 or later, which corrects the authentication logic in FreshRSS_Auth::removeAccess() to properly validate tokens using hash_equals() before accepting the attacker-supplied user parameter (Patch Commit, Release Notes). If an immediate upgrade is not possible, disable anonymous viewing in the FreshRSS instance settings to eliminate the attack surface entirely. Note that any master authentication tokens that may have been exposed to anonymous viewers prior to patching should be regenerated, as they could be used for persistent access even after upgrading (GitHub Advisory).

The vulnerability was reported by community member Inverle and acknowledged by FreshRSS maintainer Alkarex, who merged the fix (PR #8165) on December 4, 2025, and included it in the 1.28.0 release. The advisory was published on GitHub on March 8, 2026, and received coverage from automated vulnerability tracking services including VulDB, INCIBE-CERT, and ENISA's EUVD. Social media mentions were observed on Mastodon and Bluesky shortly after disclosure, primarily from automated CVE tracking accounts (GitHub Advisory, GitHub PR).