CVE-2026-56772 NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint

🗓️ 25 Jun 2026 18:08:13Reported by GoogleType

osv🔗 osv.dev👁 1 Views

NewsBlur prior to 14.5.0 has an insecure object reference enabling authenticated users to read private social data via the social interactions endpoint.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-56772	25 Jun 202618:08	–	attackerkb
CVE	CVE-2026-56772	25 Jun 202618:08	–	cve
Cvelist	CVE-2026-56772 NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint	25 Jun 202618:08	–	cvelist
EUVD	EUVD-2026-39525	25 Jun 202618:08	–	euvd
NVD	CVE-2026-56772	25 Jun 202619:16	–	nvd
Positive Technologies	PT-2026-52546	25 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-56772 NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint	25 Jun 202618:08	–	vulnrichment

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56772.json
github	www.github.com/samuelclay/NewsBlur/releases/tag/Android_14.5.0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56772
vulncheck	www.vulncheck.com/advisories/newsblur-insecure-direct-object-reference-in-social-interactions-endpoint
github	www.github.com/samuelclay/NewsBlur/commit/613c60b67cc46b3f4cae1dc2dfd8d717a39bc483
github	www.github.com/samuelclay/NewsBlur

15 Jul 2026 01:49Current

6Medium risk

Vulners AI Score6

CVSS 45.3

EPSS0.00204