CVE-2026-65319: Feedbin Information Disclosure Flaw

CVE-2026-65319 Overview

CVE-2026-65319 is an unauthenticated information disclosure vulnerability in Feedbin at commit 739884a. The flaw exists in the entries text API endpoint, which explicitly skips the authorize before-action filter. Unauthenticated attackers can send GET requests to /api/v2/entries/:id/text and iterate sequential integer entry IDs. This enumeration returns the plain-text content of every stored article, including private newsletter content, personal page-saves, and articles from any user's private subscriptions. The vulnerability is categorized under [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Any remote attacker without credentials can extract the full private article corpus of a Feedbin instance by iterating numeric IDs against a single unauthenticated endpoint.

Affected Products

Feedbin (open-source self-hosted RSS reader)
Feedbin commit 739884a
Prior revisions of app/controllers/api/v2/entries_controller.rb containing the skip_before_action :authorize, only: [:text] directive

Discovery Timeline

2026-07-21 - CVE-2026-65319 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65319

Vulnerability Analysis

Feedbin's API v2 entries controller enforces authorization through a Rails before_action :authorize filter applied at the controller level. The text action explicitly opted out of this check with skip_before_action :authorize, only: [:text]. As a result, the GET /api/v2/entries/:id/text endpoint served plain-text article content without validating the requester's session, API token, or subscription ownership.

Entry IDs are sequential integers assigned at ingestion time. An attacker can start at ID 1 and increment until reaching the current maximum, capturing every entry stored by the instance. Because Feedbin ingests private newsletters delivered to per-user email aliases and user-initiated page-saves, the exposed corpus includes content that was never intended to leave the owning user's account.

Root Cause

The root cause is a missing authentication check on a data-returning action. The controller retained before_action :correct_user, only: [:show] and before_action :limit_ids, only: [:index] but explicitly bypassed :authorize for :text. No ownership check compared the requested entry's subscription to the caller's user record, so any ID resolved to its full text response.

Attack Vector

Exploitation requires only network reachability to the Feedbin HTTP endpoint. The attacker issues sequential unauthenticated GET requests and parses the returned JSON. No user interaction, session, or prior access is required.

ruby

       respond_to :json
       before_action :correct_user, only: [:show]
       before_action :limit_ids, only: [:index]
-      skip_before_action :authorize, only: [:text]
 
       def index
         @user = current_user
// Source: https://github.com/feedbin/feedbin/commit/04b89b84189e4727ea19d84ea4a44015859b29cc
// The patch removes the skip_before_action directive, restoring the :authorize filter on the :text action.

Detection Methods for CVE-2026-65319

Indicators of Compromise

Bursts of unauthenticated GET requests to /api/v2/entries/:id/text with sequential or rapidly incrementing :id values.
Access log entries showing 2xx responses to /api/v2/entries/*/text without an accompanying Authorization header or session cookie.
Requests from a single client IP or ASN traversing a wide numeric range of entry IDs in a short window.

Detection Strategies

Alert on any /api/v2/entries/*/text request that lacks authentication material at the reverse proxy or Rails middleware layer.
Baseline normal per-client request rates against the entries API and flag deviations that resemble ID enumeration.
Correlate 200-status responses to the text endpoint with the absence of a matching authenticated user in application logs.

Monitoring Recommendations

Ship Feedbin Rails and Nginx access logs to a central store and retain them long enough to identify historical enumeration.
Monitor egress bandwidth from the Feedbin host for unusual sustained outbound response volume tied to the entries API.
Track distinct entry IDs requested per source IP per hour and alert when the count exceeds a low threshold.

How to Mitigate CVE-2026-65319

Immediate Actions Required

Update Feedbin to a revision that includes commit 04b89b84189e4727ea19d84ea4a44015859b29cc or later.
Restrict network access to the Feedbin instance to trusted networks or a VPN until the patch is applied.
Review access logs for prior unauthenticated hits against /api/v2/entries/*/text and treat matches as potential data exposure.

Patch Information

The upstream fix is applied in Feedbin commit 04b89b8, which removes the skip_before_action :authorize, only: [:text] line from app/controllers/api/v2/entries_controller.rb. After the patch, the text action is subject to the same authorize before-action filter as the rest of the controller. Refer to the VulnCheck advisory and the OSS documentation for Feedbin for the full technical writeup.

Workarounds

Block /api/v2/entries/*/text at the reverse proxy for requests missing a valid session cookie or Authorization header.
Require an authenticating layer such as HTTP basic auth or a mutual-TLS proxy in front of Feedbin until upgrade.
Rotate any credentials, tokens, or private newsletter subscription addresses that may have been referenced in exposed article content.

bash

# Nginx snippet to block unauthenticated access to the affected endpoint
location ~ ^/api/v2/entries/[0-9]+/text$ {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://feedbin_upstream;
}