Executive brief
Feedbin, a web-based RSS reader and newsletter service, suffered from a security flaw that allowed anyone to read private content without logging in. By exploiting this vulnerability, an attacker could systematically download private newsletters, saved pages, and subscription content belonging to any user. This could lead to a significant breach of user privacy and the exposure of sensitive personal information stored within the platform.
Technical details
An unauthenticated information disclosure vulnerability exists in Feedbin (up to commit 739884a) due to a missing authentication check in the API. The 'text' action in the EntriesController explicitly skipped the 'authorize' before-action filter without implementing an alternative security check. Because entry IDs are sequential integers, a remote, unauthenticated attacker could iterate through IDs via the 'GET /api/v2/entries/:id/text' endpoint to enumerate and extract the plain-text content of all articles in the database. This includes private newsletter content and personal page-saves that should only be accessible to the owning user. The issue was resolved in commit 04b89b8 by removing the authorization skip.
Affected products
- Feedbin Feedbin up to and including commit 739884a
Timeline
- 2026-05-28: disclosed: Reported privately via email
- 2026-05-28: patched: Fixed in commit 04b89b8
- 2026-07-21: advisory: NVD and VulnCheck advisory published