FreshRSS CVE-2025-59949

Exploitation requires a victim who is currently authenticated to FreshRSS (versions prior to 1.27.1) and who then visits an attacker-controlled web page (UI:R). The specific enabler is that the logout endpoint lacks a CSRF token check, and the HTML <track src> element auto-issues the cross-site request with no click required. Limiting factors that reduce real-world risk: only logged-in users are affected, the impact is availability-only (forced logout, recoverable by re-authenticating rather than data loss or code execution), and the victim must load the malicious content; it does not grant the attacker any access to the account or its data.

Signals point to a genuine but low-priority medium-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) describes a network-reachable CSRF that needs no attacker privileges but does need victim interaction (UI:R), with impact limited to availability only (C:N/I:N). EPSS is low at 0.45% (37th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation - exploitation status here is 'publicly available exploit code exists' (POC referenced in the GitHub Security Advisory), which is a distinct and weaker signal than active exploitation. No SSVC decision data was supplied. The key tension is the A:H rating: the described impact is a forced logout (denial of service), which is user-specific and fully recoverable by re-authenticating, so A:H appears to overstate the real-world availability impact - I would assess this closer to A:L (see assessed vector). Net: a real, patchable CSRF worth fixing, but not an urgent priority given low EPSS, no KEV, availability-only impact, and the UI:R requirement.

An attacker hosts a web page containing a <track src> element pointing at the FreshRSS logout endpoint and lures an authenticated FreshRSS user to visit it. Because the logout action lacks CSRF protection and the <track> element auto-fetches its source without a click, the victim's browser silently issues the forged logout request, terminating their session; a page that repeatedly triggers this produces a sustained denial of service. Public exploit/POC details are referenced in the vendor's GitHub Security Advisory (GHSA-w7f5-8vf9-f966).