CVE-2026-56772
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
NewsBlur before version 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.
Risk Assessment
The risk is the potential for unauthorized access to private social data of users, which can lead to confidentiality and privacy breaches, and enable attackers to gather information about relationships and activities of other individuals.
Recommendation
Immediately update NewsBlur to version 14.5.0 or later, which includes a fix for this vulnerability. Additionally, implement ownership verification mechanisms for all endpoints requiring access to user data.
Other vulnerabilities in NewsBlur
Original NVD description (English source)
NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.