# CVE-2023-27591: Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

Source: https://junglewise.ai/threats/cve-2023-27591-unauthenticated-miniflux-user-can-bypass-allowed-networks-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-02  
License: CC BY 4.0 with a link back

CVE-2023-27591 · Severity: low · CVSS 3.1 · Published 2025-04-02

Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

Technologies: [miniflux.app (Go)](https://junglewise.ai/threats/technologies/miniflux-app), [miniflux.app/v2 (Go)](https://junglewise.ai/threats/technologies/miniflux-app-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2023-27591 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-27591 being exploited in the wild.

**How severe is CVE-2023-27591?** Low severity, with a CVSS score of 3.1, published 2 April 2025.

**Which products and versions are affected?** miniflux.app (Go) SEMVER:introduced=0,last_affected=1.0.46; miniflux.app/v2 (Go) SEMVER:introduced=0,fixed=2.0.43.

**Is there a fix for CVE-2023-27591?** Yes. miniflux.app/v2 (Go): upgrade to 2.0.43 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2023-27591?** Check whether you run miniflux.app (Go) or miniflux.app/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- miniflux.app/v2 (Go): upgrade to 2.0.43 or later

  ```sh
  go get miniflux.app/v2@v2.0.43
  ```


## Affected products

- miniflux.app (Go) SEMVER:introduced=0,last_affected=1.0.46
- miniflux.app/v2 (Go) SEMVER:introduced=0,fixed=2.0.43

## Identifiers

- CVE-2023-27591
- GHSA-3qjf-qh38-x73v

## Related threats

- [Miniflux miniflux-v2 open redirect bypass](https://junglewise.ai/threats/cve-2026-55185-miniflux-miniflux-v2-open-redirect-bypass)
- [GO-2026-4287 - Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app](https://junglewise.ai/threats/cve-2026-21885-miniflux-media-proxy-ssrf-via-proxy-endpoint-allows-access-to)
- [GO-2025-4226 - Miniflux has an Open Redirect via protocol-relative redirect_url in miniflux.app](https://junglewise.ai/threats/cve-2025-67713-miniflux-has-an-open-redirect-via-protocol-relative-redirect-url)
- [Miniflux Media Proxy vulnerable to Stored Cross-site Scripting due to improper Content-Security-Policy configuration](https://junglewise.ai/threats/cve-2025-31483-miniflux-media-proxy-vulnerable-to-stored-cross-site-scripting)
- [Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler](https://junglewise.ai/threats/cve-2023-27592-stored-xss-in-miniflux-when-opening-a-broken-image-due-to)