← Database

CVE-2026-125372

MEDIUM CVSS: 4.3 Published: 2026-11-10 Modified: 2026-11-10

Description

REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments.

Affected Platforms

Unknown

Weakness Type

CWE-639

References