CVE-2026-125372: REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpoints
REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated with a REBUILD account. The affected endpoints allow that user to enumerate sequential feed IDs and access content that should be restricted to private or team-scoped audiences.
What information could be exposed?
Successful exploitation can disclose private or team-scoped feed content, including images, attachments, and comments. The provided data indicates confidentiality impact only; it does not describe integrity or availability impact.
Which versions are affected?
REBUILD versions before 4.5.3 are affected. The issue is in the feeds-details and comments-list endpoints handled by FeedsListController.