Access Control Flaw in NewsBlur by Samuel Clay

CVE-2026-56772

What is CVE-2026-56772?

NewsBlur prior to version 14.5.0 is vulnerable to a broken access control issue that permits authenticated users to exploit the system improperly. By manipulating the user_id parameter in the GET /social/interactions API endpoint, users can access the private notification feeds of others without proper authorization. This flaw particularly allows for the enumeration of user_id values, enabling attackers to gain insight into another user's follows, personal replies, and overall social activity, thereby compromising user privacy and security.

References