Which versions of Feedbin are affected by CVE-2026-65319?

Feedbin self-hosted RSS readers running commit 739884a or earlier allow unauthenticated attackers to read all users' private article content through sequential API ID enumeration.

How to fix or mitigate CVE-2026-65319?

Within 24 hours: confirm whether your Feedbin instance runs commit 739884a or earlier by checking deployed version; immediately restrict the /api/v2/entries/:id/text endpoint to authenticated users only via reverse proxy authentication rules or WAF, blocking all unauthenticated requests. Within 7 days: audit API access logs to identify potential exploitation attempts (high-volume /api/v2/entries requests from external IPs); initiate incident response if enumeration patterns detected; notify affected users of exposure window. Within 30 days: continue monitoring vendor channels for a security patch; once released, test and deploy immediately; confirm remediation by validating that unauthenticated /api/v2/entries requests are rejected.

Feedbin CVE-2026-65319

Q: What is the CVSS score of CVE-2026-65319?

CVE-2026-65319 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47563 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 disclosure@vulncheck.com

GHSA-625r-xrww-9rxq

Authentication Bypass Information Disclosure

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable API with no auth or interaction (AV:N/AC:L/PR:N/UI:N); read-only disclosure of private content gives C:H with no integrity or availability impact and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 21, 2026 - 23:30 vuln.today

Analysis Generated

Jul 21, 2026 - 23:30 vuln.today

CVE Published

Jul 21, 2026 - 22:19 cve.org

HIGH 8.7

DescriptionCVE.org

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterate sequential integer entry IDs through the GET /api/v2/entries/:id/text endpoint to enumerate and extract plain-text content of all stored articles, including private newsletter content, personal page-saves, and articles from any user's private subscriptions.

AnalysisAI

Unauthenticated information disclosure in Feedbin (self-hosted RSS reader, commit 739884a) lets remote attackers read any user's private article content via GET /api/v2/entries/:id/text, which explicitly skipped the authorization filter. Because entry IDs are sequential integers, an attacker can enumerate and harvest plain-text bodies of private newsletters, page-saves, and articles from every user's private subscriptions across the instance. No public exploit identified at time of analysis, though a technical write-up describing the flaw exists; the CVSS 4.0 base score is 8.7 (High) driven purely by confidentiality impact.

Technical ContextAI

Feedbin is a Ruby on Rails RSS/feed reader application. The vulnerability is a classic CWE-306 Missing Authentication for a Critical Function: the EntriesController for the v2 API contained skip_before_action :authorize, only: [:text], which removed the app-wide authorization before-action filter specifically for the text action serving GET /api/v2/entries/:id/text. As a result, that endpoint returned the extracted plain-text article body for any entry ID without verifying that the requesting session/user was entitled to it. The fix (commit 04b89b84189e4727ea19d84ea4a44015859b29cc) simply deletes the skip_before_action line, restoring the normal authorization check. The Rails pattern of before_action authorization means one stray skip directive silently exposed an otherwise-protected resource, and because entry IDs are monotonic integers there is no unguessable identifier acting as a secondary control.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit 04b89b84189e4727ea19d84ea4a44015859b29cc, which removes the skip_before_action :authorize, only: [:text] line so the /api/v2/entries/:id/text action is again covered by the standard authorization filter; self-hosted operators should pull the latest main branch past that commit and redeploy. No tagged patched release version was provided in the intelligence, so verify against the vendor repository before assuming a specific version is safe. As an interim compensating control until the fix is deployed, restrict or block access to the GET /api/v2/entries/:id/text endpoint at the reverse proxy or WAF layer, or require an authenticated session at the proxy for the entire /api/v2/ path - the trade-off is that legitimate API clients relying on the text endpoint (e.g., mobile or third-party readers) will break until the code fix is applied. Reference the VulnCheck advisory at https://www.vulncheck.com/advisories/feedbin-unauthenticated-entry-content-disclosure-via-get-api-v2-entries-id-text.