Script execution or privilege escalation via frame embedding

Clickjacking in FreshRSS 1.26.3 and earlier allows remote attackers to execute JavaScript or promote a user through a crafted page. Affected responses omit a Content-Security-Policy frame-ancestors restriction, allowing attacker-controlled pages to embed authenticated extension and user-management views in obscured iframes. Exploitation requires a logged-in Firefox user to perform disguised clicks or drag-and-drop actions; the XSS path also depends on the default UserJS extension, and the bounded effects are same-origin script execution or promotion of an existing account.