CVE-2026-125376
Received Received - Intake

Unauthenticated Information Disclosure in VanBlog

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulnCheck

Description
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125376
EUVD
EUVD-2026-120539

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Mereithhh vanblog From 0 (inc) to 0.54.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

VanBlog through 0.54.0 has an information disclosure vulnerability. Unauthenticated attackers can read private or hidden articles by accessing the POST /api/public/article/:id endpoint. The vulnerability occurs because the getByIdWithPassword function does not check the hidden flag, allowing full article content to be exposed even without proper authentication.

Detection Guidance

To detect this vulnerability, check if your VanBlog instance allows unauthenticated access to private or hidden articles via the POST /api/public/article/:id endpoint. Test by sending a POST request to /api/public/article/:id with a non-empty password for private articles or without a password for hidden articles. If the response returns full article content, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to access sensitive or confidential articles without authentication. If your VanBlog instance contains private or hidden content, attackers could read it, leading to data leaks, privacy violations, or unauthorized access to restricted information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it exposes personal or health data. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach via this vulnerability may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately update VanBlog to the latest version beyond 0.54.0 to patch the vulnerability. If an update is unavailable, restrict access to the /api/public/article/:id endpoint via firewall rules or web server configuration. Ensure all private and hidden articles have proper password protection enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125376. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...