Vulnerability Description
Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterate sequential integer entry IDs through the GET /api/v2/entries/:id/text endpoint to enumerate and extract plain-text content of all stored articles, including private newsletter content, personal page-saves, and articles from any user's private subscriptions.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/feedbin/feedbin
- https://github.com/feedbin/feedbin/commit/04b89b84189e4727ea19d84ea4a44015859b29
- https://github.com/geo-chen/oss/blob/main/feedbin.md
- https://www.vulncheck.com/advisories/feedbin-unauthenticated-entry-content-discl
- https://github.com/geo-chen/oss/blob/main/feedbin.md
FAQ
What is CVE-2026-65319?
CVE-2026-65319 is a vulnerability with a CVSS score of 7.5 (HIGH). Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries t...
How severe is CVE-2026-65319?
CVE-2026-65319 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65319?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.