CVE-2026-125376

MEDIUM 5.3

VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content.

CWE	CWE-863
Vendor	mereithhh
Product	vanblog
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for mereithhh vanblog

Be the first to know when new medium vulnerabilities affecting mereithhh vanblog are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Mereithhh / vanblog

0 ≤ 0.54.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Mereithhh/vanblog/issues/611 github.com: https://github.com/Mereithhh/vanblog github.com: https://github.com/Mereithhh/vanblog/blob/8eb670b88e05572fd3c6039a89759abb6745dcab/packages/server/src/provider/article/article.provider.ts#L751-L780 github.com: https://github.com/Mereithhh/vanblog/commit/81b868f4d568c8accff62b9c35d0e556d1e7970d vulncheck.com: https://www.vulncheck.com/advisories/vanblog-through-0.54.0-private-article-disclosure-via-public-password-endpoint

Credits

hieuPenguinnn