CVE-2026-56771
NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint
- State
- Published
- Severity
- 6.3 Medium
- Published
- Jun 25, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jun 23, 2026
Description
NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and cloud metadata endpoints, enabling internal network scanning and sensitive data exfiltration.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N | VulnCheck |
| 3.1 | 8.5 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
NewsBlursamuelclay |
|
References
- Release Notesrelease-notes
- Patch Commit (1)patch
- Patch Commit (2)patch
- https://www.vulncheck.com/advisories/newsblur-server-side-request-forgery-via-add-url-endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.