Authorization Bypass Vulnerability in REBUILD by getrebuild

CVE-2026-125372

What is CVE-2026-125372?

The REBUILD platform, prior to version 4.5.3, has a vulnerability that allows authenticated attackers to bypass authorization checks related to fetching details and comments through the FeedsListController. This bypass results from the failure to enforce privilege filtering when utilizing the feeds-details and comments-list endpoints. By exploiting this flaw, attackers can enumerate IDs sequentially, potentially accessing private or team-scoped content, images, attachments, and comments that should remain restricted. This vulnerability emphasizes the importance of implementing robust access control measures to protect sensitive data from unauthorized access.

References