CVE-2026-125372

Description

REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/getrebuild/rebuild/issues/1139 ↗
• https://github.com/getrebuild/rebuild ↗
• https://github.com/getrebuild/rebuild/blob/af00afcc22476b889c06c3db6032fd94a1454cfa/src/main/java/com/rebuild/web/feeds/FeedsListController.java#L190-L194 ↗
• https://github.com/getrebuild/rebuild/commit/03959a464164e12e87443c689043ceccf56044f3 ↗
• https://github.com/getrebuild/rebuild/releases/tag/4.5.3 ↗
• https://www.vulncheck.com/advisories/rebuild-before-4.5.3-authorization-bypass-via-feeds-details-and-comments-endpoints ↗