CVE-2026-65319

Deferred Deferred - Pending Action

Unauthenticated Information Disclosure in Feedbin

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: VulnCheck

Description

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterate sequential integer entry IDs through the GET /api/v2/entries/:id/text endpoint to enumerate and extract plain-text content of all stored articles, including private newsletter content, personal page-saves, and articles from any user's private subscriptions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-65319

EUVD

EUVD-2026-47563

Affected Vendors & Products

Vendor	Product	Version / Range
feedbin	feedbin	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability in Feedbin allows unauthenticated attackers to access private article content by exploiting an unauthenticated information disclosure issue. Attackers can send requests to the entries text API endpoint using sequential integer IDs to retrieve plain-text content of all stored articles, including private newsletter content and personal saves.

Detection Guidance

To detect this vulnerability, monitor network traffic for requests to the GET /api/v2/entries/:id/text endpoint with sequential integer IDs. Check server logs for unauthorized access patterns or repeated requests to this endpoint.

Impact Analysis

This vulnerability could allow attackers to read private or sensitive article content without authorization. If you use Feedbin to store confidential information, personal notes, or private subscriptions, those contents could be exposed. The attack requires no authentication and can be automated to extract large amounts of data.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA if it results in unauthorized access to personal or sensitive data. Organizations using Feedbin may face legal consequences, fines, or reputational damage due to the exposure of private user information.

Mitigation Strategies

Immediately restrict access to the /api/v2/entries/:id/text endpoint by implementing authentication and authorization checks. Update Feedbin to the latest patched version if available. Review server logs for signs of exploitation and block suspicious IP addresses.

Hi! I’m here to help you understand CVE-2026-65319. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70