PT-2026-52545 · Samuelclay · Newsblur

George Chen · Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-56771

Mitre

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and cloud metadata endpoints, enabling internal network scanning and sensitive data exfiltration.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-56771

Produtos afetados

Newsblur

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-56771 · Nota de Segurança
• https://github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0 · Nota
• https://vulncheck.com/advisories/newsblur-server-side-request-forgery-via-add-url-endpoint · Nota
• https://github.com/samuelclay/NewsBlur/commit/af742daeca7cc6c8b0d58cbea381e7bc44daa520 · Correção
• https://github.com/samuelclay/NewsBlur/commit/2e6c6812c94f35a731bda864de5aef39f18307f1 · Correção