CVE-2026-56772: Samuelclay Newsblur

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the GET /social/interactions endpoint without ownership verification. Attackers can enumerate user_id values to access another user's follows, replies, and social activity without authorization.

Affected products

• Samuelclay Newsblur: before 14.5.0 (fixed in 14.5.0)

Published 2026-06-25. Last modified 2026-07-14.