CVE-2026-125376: VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit the affected public article endpoint. No account, privileges, or user interaction are required.
What articles are exposed?
Private articles without an effective password can be read by supplying any non-empty password. Hidden articles can also be retrieved because the affected lookup does not check the hidden flag.
Is a valid article password required?
Not for a private article that lacks an effective password: any non-empty password is accepted. The provided data does not establish whether properly configured private articles with effective passwords are exposed.
How can I determine whether an article is affected?
Review private articles for missing or ineffective password protection and identify hidden articles. On affected versions through 0.54.0, the public POST /api/public/article/:id endpoint may return their full content.