CVE-2026-56771 json
NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint
published 2026-06-25 4 mo ago modified 2026-11-08 25 h ago also EUVD-2026-39524
- cvss
- 8.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and cloud metadata endpoints, enabling internal network scanning and sensitive data exfiltration.
Patch / fix
- samuelclay NewsBlur 14.5.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N |
| CNA | 3.1 | 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- samuelclay NewsBlur
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/samuelclay/NewsBlur/commit/2e6c6812c94f35a731bda864de5aef39f18307f1
patch
-
github.com
/samuelclay/NewsBlur/commit/af742daeca7cc6c8b0d58cbea381e7bc44daa520
patch
-
github.com
/samuelclay/NewsBlur/releases/tag/Android_14.5.0
release-notes
-
vulncheck.com
/advisories/newsblur-server-side-request-forgery-via-add-url-endpoint
third-party-advisory
Sources
- CVE List CVE-2026-56771
- NVD CVE-2026-56771
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.