A critical access control vulnerability in FreshRSS allows unauthenticated attackers to gain unauthorized access to sensitive feed and tag information.

This is an improper access control vulnerability (CWE-284) residing in the FreshRSS_Auth::hasAccess() implementation. Because certain controllers and endpoints fail to perform manual access checks or utilize the required firstAction() method, unauthenticated users can bypass security restrictions.

The exploitation of this vulnerability leads to the unauthorized disclosure of sensitive configuration and user data, specifically regarding feeds and tags associated with administrative accounts. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to data privacy and operational security, as it allows attackers to map internal system structures without requiring valid credentials.

Immediate Action: Update the FreshRSS installation to version 1.27.0 or later to ensure the necessary access control checks are correctly enforced across all endpoints.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at tag or feed management endpoints originating from unauthorized IP addresses.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to sensitive RSS aggregator endpoints and ensure that administrative interfaces are not exposed to the public internet.

Public Exploit Available: Unknown.

Given the exposure of administrative information and the availability of a proof-of-concept, administrators should prioritize patching this vulnerability immediately. Upgrading to version 1.27.0 is the only reliable method to remediate the underlying access control logic flaw and secure the RSS aggregator against unauthorized data harvesting.