MEDIUM 5.3 NVD
CVE-2026-125372
REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and Fee
REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments.
References
- https://github.com/getrebuild/rebuild
- https://github.com/getrebuild/rebuild/blob/af00afcc22476b889c06c3db6032fd94a1454cfa/src/ma
- https://github.com/getrebuild/rebuild/commit/03959a464164e12e87443c689043ceccf56044f3
- https://github.com/getrebuild/rebuild/issues/1139
- https://github.com/getrebuild/rebuild/releases/tag/4.5.3
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-10 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.