FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of service via <track src>. Version 1.27.1 patches the issue.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/FreshRSS/FreshRSS/pull/7958 Issue Tracking, Patch
- https://github.com/FreshRSS/FreshRSS/pull/7997 Issue Tracking, Patch
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w7f5-8vf9-f966 Exploit, Vendor Advisory
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w7f5-8vf9-f966 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · freshrssNVD modified 2026-10-13 11:10
Affected (CPE criteria) 1
cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*
References 5
- https://github.com/FreshRSS/FreshRSS/pull/7958 Issue Tracking, Patch
- https://github.com/FreshRSS/FreshRSS/pull/7997 Issue Tracking, Patch
- https://github.com/FreshRSS/FreshRSS/pull/7999 Issue Tracking
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w7f5-8vf9-f966 Exploit, Vendor Advisory
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-w7f5-8vf9-f966 Exploit, Vendor Advisory