CVE-2026-128331: Miniflux before 2.3.5 Password Change Without Current Password via Settings Form
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.3.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any Miniflux account with an active signed-in session is exposed in versions before 2.3.5. The relevant risk is greatest where an attacker can obtain a session cookie or access an unattended device that is already signed in.
What does an attacker need to exploit it?
The attacker needs control of a valid authenticated session. They can then submit new password fields through the updateSettings functionality without knowing the account's existing password.
How can this affect the account owner?
An attacker can set a new password, locking out the legitimate owner and taking over the account. The provided information does not indicate any impact on confidentiality or availability beyond the account takeover scenario.