CVE-2026-128331
Deferred Deferred - Pending Action

Unverified Password Change in Miniflux

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128331
EUVD
EUVD-2026-125046

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miniflux miniflux From 0 (inc) to 2.3.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Miniflux before version 2.3.5 has a flaw where an attacker with an active session can change a user's password without knowing the current password. This is done by submitting new password fields through the updateSettings endpoint. Attackers could exploit a stolen session cookie or an unattended device to lock out the legitimate user and take over the account.

Impact Analysis

If you use Miniflux before 2.3.5, an attacker could gain full control of your account by changing the password. This could lead to unauthorized access to your data, loss of account ownership, and potential misuse of your session. The impact is higher if your session is compromised through stolen cookies or unattended devices.

Mitigation Strategies

Upgrade Miniflux to version 2.3.5 or later to address the unverified password change vulnerability. Review active sessions and revoke any suspicious or unattended sessions. Ensure session cookies are securely stored and not exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128331. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...