CVE-2026-56772: NewsBlur Broken Access Control in Social Interactions

Technical summary

CVE-2026-56772 is a broken access control vulnerability in the GET /social/interactions endpoint of NewsBlur prior to version 14.5.0. The endpoint accepts a user_id parameter but does not validate that the authenticated requester is the account owner or has explicit authorization to retrieve that user's notification feed. An attacker can enumerate user_id values to iterate through the user base and harvest follows, replies, and social activity metadata. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and carries a CVSS v3.1 score of 4.3 (Medium severity, requiring authentication but allowing confidentiality breach with no integrity or availability impact).

Business impact

This vulnerability permits unauthorized information disclosure of user social graphs and activity within a NewsBlur deployment. For organizations or communities using NewsBlur for internal collaboration, research coordination, or social networking, attackers can map relationships between users, identify who follows whom, and infer organizational structure or research interests. The issue does not enable data modification or service disruption, but the privacy breach can erode user trust and violate data protection obligations if deployment is in a regulated environment. The attack requires authentication, limiting blast radius to accounts with access to the instance.

Affected systems

NewsBlur installations prior to version 14.5.0 are affected. Because NewsBlur is typically self-hosted, exposure depends on whether the instance is internet-facing and whether user registration is open or restricted. Organizations running NewsBlur internally with controlled authentication (e.g., LDAP, single sign-on) remain vulnerable to lateral reconnaissance by insiders. The advisory does not specify which earlier major versions are affected; confirm your deployment version and check the NewsBlur release notes or vendor advisory for precise patch availability.

Exploitability

Exploitability is straightforward. An attacker requires only a valid authenticated session—either through account creation (if registration is open) or credential compromise. No special privileges, interaction with victims, or advanced techniques are needed. User ID enumeration is typically trivial in most web applications. The low complexity and high accessibility make this a moderate risk in accessible deployments, but the requirement for prior authentication significantly limits the attack surface compared to unauthenticated exploits.

Remediation

Upgrade NewsBlur to version 14.5.0 or later. The patch implements ownership verification on the /social/interactions endpoint, ensuring that only the account owner or authorized users can retrieve a given user_id's notification feed. After patching, conduct a user audit to identify whether any unauthorized access occurred during the window of vulnerability. Consider restricting user registration or implementing network-level access controls to limit who can authenticate to the instance.

Patch guidance

Consult the official NewsBlur release notes and security advisory to confirm version 14.5.0 is available for your deployment method (Docker, direct installation, managed hosting, etc.). Apply the update during a maintenance window; no breaking changes are indicated, but test in a staging environment first. If you are on a version significantly older than 14.5.0, verify the update path and any intervening dependency or configuration changes. Once patched, verify the fix by confirming that attempts to access another user's /social/interactions endpoint with a different user_id fail with a 403 Forbidden or similar authorization error.

Detection guidance

Monitor access logs for repeated or systematic requests to the GET /social/interactions endpoint with varying user_id parameters from the same source IP or user account. Implement alerting on high-frequency endpoint queries or parameter enumeration patterns. If you have not yet patched, query your access logs for patterns such as sequential or bulk user_id requests to this endpoint as an indicator of exploitation. Web application firewalls (WAFs) or application behavior monitoring tools can detect anomalous enumeration activity, though the attack is otherwise difficult to distinguish from legitimate use without endpoint-level inspection of request parameters.

Why prioritize this

Although the CVSS score is Medium (4.3), prioritize patching in the following order: (1) Internet-facing NewsBlur instances with open registration or public access—these have the highest exploitation risk; (2) multi-tenant or collaborative deployments where privacy of user relationships is sensitive; (3) internal instances with restricted access where insider threat risk is lower. The vulnerability is not on the KEV catalog and does not yet have documented active exploitation. However, the simplicity of exploitation and lack of mitigating factors in the application logic make it a practical attack once an account is obtained.

Risk score, explained

The CVSS v3.1 score of 4.3 (Medium) reflects low attack complexity, the requirement for prior authentication (PR:L), no user interaction, and limited confidentiality impact. The score appropriately captures that an attacker must have a valid account, significantly reducing the attacker pool compared to unauthenticated flaws. However, the ease of exploitation and the direct disclosure of private user data (social graphs, activity) mean the real-world risk within a vulnerable deployment is higher than the base score alone suggests. Context—such as whether the instance is open to the internet or contains sensitive research communities—should inform your internal risk rating.

Frequently asked questions