EUVD-2026-39525
GHSA-vg32-rqh8-j8pm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible IDOR requiring a low-privilege authenticated session; confidentiality limited to social metadata with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.
AnalysisAI
Broken access control in NewsBlur before 14.5.0 exposes any authenticated user's private social notification feed - follows, replies, and social activity - to any other authenticated user. The GET /social/interactions endpoint accepts an arbitrary user_id parameter and returns that user's MInteraction records without verifying the requesting session owns the account, a classic CWE-639 IDOR. No public exploit code has been identified and this is not listed in CISA KEV, but the low attack complexity (any registered account suffices) makes the flaw trivially exploitable by any NewsBlur user against any other.
Technical ContextAI
NewsBlur is a Django-based RSS reader and social news aggregator (CPE: cpe:2.3:a:samuelclay:newsblur:*:*:*:*:*:*:*:*). The vulnerable surface is the load_interactions view function in apps/social/views.py, exposed at GET /social/interactions. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the endpoint accepted a caller-supplied user_id query parameter and fetched MInteraction MongoDB documents for that ID without comparing it to the authenticated session's user.pk. The fix in commit 613c60b67cc46b3f4cae1dc2dfd8d717a39bc483 adds an explicit identity check - if the supplied user_id differs from the authenticated user, it returns HTTP 200 with code -1 and 'Access denied.' The same commit extends equivalent ownership checks to the load_river_blurblog and story_public_comments endpoints, and adds profile-level suppression of private follow/follower lists for non-followers, indicating the access control gap was broader than a single endpoint.
RemediationAI
Upgrade to NewsBlur 14.5.0 or later; the authorization fix is present in commit 613c60b67cc46b3f4cae1dc2dfd8d717a39bc483 (https://github.com/samuelclay/NewsBlur/commit/613c60b67cc46b3f4cae1dc2dfd8d717a39bc483) and tagged at https://github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0. For self-hosted operators who cannot immediately patch, a compensating control is to block unauthenticated and cross-user API requests at the reverse proxy by enforcing session-to-user-id consistency - note this requires application-aware middleware and cannot be enforced purely at the network layer without side effects on legitimate API usage. Restricting the /social/interactions, /social/river_blurblog, and /reader/public_comments endpoints to internal networks only is a blunt but effective control, at the cost of disabling these features for external users. No vendor workaround short of the patch was identified in the advisory at https://www.vulncheck.com/advisories/newsblur-insecure-direct-object-reference-in-social-interactions-endpoint.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today