Medium severity4.3NVD Advisory· Published Nov 10, 2026· Updated Nov 10, 2026
CVE-2026-125372
CVE-2026-125372
Description
REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.5.3
Patches
Vulnerability mechanics
References
5- github.com/getrebuild/rebuild/blob/af00afcc22476b889c06c3db6032fd94a1454cfa/src/main/java/com/rebuild/web/feeds/FeedsListController.javanvd
- github.com/getrebuild/rebuild/commit/03959a464164e12e87443c689043ceccf56044f3nvd
- github.com/getrebuild/rebuild/issues/1139nvd
- github.com/getrebuild/rebuild/releases/tag/4.5.3nvd
- www.vulncheck.com/advisories/rebuild-before-4.5.3-authorization-bypass-via-feeds-details-and-comments-endpointsnvd
News mentions
0No linked articles in our index yet.