What’s Vulnerable › Vulnerabilities

CVE-2026-56772: NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-25 · updated 2026-10-25
• Weakness: CWE-639

Description

NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.

Affected products

• samuelclay NewsBlur: before 14.5.0 — fixed in 14.5.0

How to fix

Upgrade to a fixed version: samuelclay NewsBlur 14.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/samuelclay/NewsBlur/commit/613c60b67cc46b3f4cae1dc2dfd8d717a39bc483
• https://github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0
• https://www.vulncheck.com/advisories/newsblur-insecure-direct-object-reference-in-social-interactions-endpoint

Get alerted when CVE-2026-56772 or the next vulnerability affects your stack