CVE-2026-56771
NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint
CVSS Score
8.5
EPSS Score
0.0%
EPSS Percentile
0th
NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and cloud metadata endpoints, enabling internal network scanning and sensitive data exfiltration.
| CWE | CWE-918 |
| Vendor | samuelclay |
| Product | newsblur |
| Published | Jun 25, 2026 |
| Last Updated | Jun 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for samuelclay newsblur
Be the first to know when new high vulnerabilities affecting samuelclay newsblur are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
None
Affected Versions
samuelclay / NewsBlur
0 < 14.5.0
References
github.com: https://github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0 github.com: https://github.com/samuelclay/NewsBlur/commit/2e6c6812c94f35a731bda864de5aef39f18307f1 github.com: https://github.com/samuelclay/NewsBlur/commit/af742daeca7cc6c8b0d58cbea381e7bc44daa520 vulncheck.com: https://www.vulncheck.com/advisories/newsblur-server-side-request-forgery-via-add-url-endpoint
Credits
George Chen