CVE-2026-65319
Feedbin Unauthenticated Entry Content Disclosure via GET /api/v2/entries/:id/text
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterate sequential integer entry IDs through the GET /api/v2/entries/:id/text endpoint to enumerate and extract plain-text content of all stored articles, including private newsletter content, personal page-saves, and articles from any user's private subscriptions.
| CWE | CWE-306 |
| Vendor | feedbin |
| Product | feedbin |
| Published | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for feedbin feedbin
Be the first to know when new high vulnerabilities affecting feedbin feedbin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Feedbin / Feedbin
0 ≤ 739884a
References
github.com: https://github.com/geo-chen/oss/blob/main/feedbin.md github.com: https://github.com/feedbin/feedbin/commit/04b89b84189e4727ea19d84ea4a44015859b29cc github.com: https://github.com/feedbin/feedbin vulncheck.com: https://www.vulncheck.com/advisories/feedbin-unauthenticated-entry-content-disclosure-via-get-api-v2-entries-id-text
Credits
🔍 George Chen