Executive brief
NewsBlur, a personal news reader and social network, contained a security flaw in its social interaction features. An authenticated user could view the private activity of other users, including their follows and replies, by manipulating user identification numbers in web requests. This could lead to the unauthorized exposure of private social data and user activity patterns.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in NewsBlur's social interactions endpoint. The root cause is a lack of ownership verification when processing GET requests to /social/interactions; the application fails to verify if the requesting user is authorized to view the data associated with the provided user_id. An authenticated attacker can exploit this by enumerating user_id values to access unauthorized social activity data, including follows and replies. This issue is addressed in version 14.5.0.
Affected products
- Samuel Clay NewsBlur before 14.5.0
Timeline
- 2026-06-02: patched: Fix social IDOR access checks commit published
- 2026-06-12: advisory: Release 14.5.0 published
- 2026-06-25: disclosed: NVD publication date