Double Clickjacking Vulnerability in FreshRSS by FreshRSS

CVE-2025-59950

What is CVE-2025-59950?

In FreshRSS versions 1.26.3 and earlier, a vulnerability allows for double clickjacking attacks. Attackers can exploit this security flaw to lure an administrator into clicking a deceptive Promote button on other users' management pages. This is achieved by embedding a malicious link within an attacker-controlled webpage. Once the admin is tricked into performing the double-click action, the attacker can elevate their own permissions to admin and gain unauthorized access to other users' accounts. The vulnerability has been addressed in FreshRSS version 1.27.0.

References