Executive brief
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
Affected products
- Go miniflux.app
- Go miniflux.app/v2
Junglewise Threat Intelligence
CVE-2023-27591: Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
CVE-2023-27591 · Severity: low · CVSS 3.1 · Published 2025-04-02
Technologies: miniflux.app (Go), miniflux.app/v2 (Go). Vendors: Go.
Related threats
- Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backs
- GO-2026-4287 - Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app
- GO-2025-4226 - Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app
- GO-2025-3591 - Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration in miniflux.app
- Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler