{"id":"CVE-2026-125372","kind":"vulnerability","aliases":["CVE-2026-125372"],"related":[],"title":"REBUILD: authenticated users read private feed content by changing IDs","description":"REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments.","summary":"REBUILD versions before 4.5.3 fail to apply privilege filtering in the feed details and comments endpoints. An attacker with a logged-in account can step through sequential IDs to read private or team-scoped feeds, images, attachments and comments.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","rebuild","self-hosted"],"not_affected_if":["version-4.5.3-or-later"],"how_to_check":"- Check the installed REBUILD version; versions before `4.5.3` are affected.\n- Review whether `FeedsListController` `fetchDetails` and `fetchComments` are reachable by ordinary user accounts.","fix":"- REBUILD: upgrade to `4.5.3` or later.","status":"open","published_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:30:41+00:00","updated_at":"2026-11-10T00:30:41+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-10T00:30:41Z","model":"claude-haiku-5-5","output":{"fix":"- REBUILD: upgrade to `4.5.3` or later.","reach":"unknown","title":"REBUILD: authenticated users read private feed content by changing IDs","impact":"medium","summary":"REBUILD versions before 4.5.3 fail to apply privilege filtering in the feed details and comments endpoints. An attacker with a logged-in account can step through sequential IDs to read private or team-scoped feeds, images, attachments and comments.","audience":"businesses","category":"other","nicknames":[],"who_cares":["rebuild","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Logged-in user reads private feeds, attachments and comments","analyst_note":"","how_to_check":"- Check the installed REBUILD version; versions before `4.5.3` are affected.\n- Review whether `FeedsListController` `fetchDetails` and `fetchComments` are reachable by ordinary user accounts.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.5.3-or-later"],"who_is_affected":"Any REBUILD deployment before 4.5.3 is exposed to logged-in users, since the flaw is an authorization bypass on the feed detail and comment endpoints. Teams that run REBUILD internally with trusted users only face lower practical risk, but private team content is still readable by any account. Installations already on 4.5.3 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001087,"input_tokens":4635,"output_tokens":1246,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125372':13A,16A '-2026':12A,15A '4.5.3':25B,65C 'account':45B 'appli':28B 'attach':60B,109C 'attack':39B,84C 'authent':2A,83C 'author':68C 'bypass':69C 'chang':9A 'check':82C 'comment':36B,62B,96C,111C 'comments-list':95C 'contain':66C 'content':7A,107C 'cve':11A,14A 'detail':34B,93C 'endpoint':37B,98C 'enumer':86C 'fail':26B 'feed':6A,33B,58B,92C,106C 'feeds-detail':91C 'feedshelper.checkreadable':81C 'feedslistcontrol':72C 'fetchcom':75C 'fetchdetail':73C 'filter':30B,79C 'host':21B 'id':10A,50B,88C 'imag':59B,108C 'list':97C 'log':43B 'logged-in':42B 'privat':5A,53B,101C 'privileg':29B,78C 'read':4A,52B,100C 'rebuild':1A,18B,22B,63C 'scope':57B,105C 'self':20B 'self-host':19B 'sequenti':49B,87C 'skip':77C 'step':47B 'team':56B,104C 'team-scop':55B,103C 'user':3A 'version':23B 'via':89C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Any REBUILD deployment before 4.5.3 is exposed to logged-in users, since the flaw is an authorization bypass on the feed detail and comment endpoints. Teams that run REBUILD internally with trusted users only face lower practical risk, but private team content is still readable by any account. Installations already on 4.5.3 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","rebuild","selfhosted"],"campaign_type":null,"search_a":"'-125372':13A,16A '-2026':12A,15A 'authent':2A 'chang':9A 'content':7A 'cve':11A,14A 'feed':6A 'id':10A 'privat':5A 'read':4A 'rebuild':1A 'user':3A","search_b":"'4.5.3':25B 'account':45B 'appli':28B 'attach':60B 'attack':39B 'comment':36B,62B 'detail':34B 'endpoint':37B 'fail':26B 'feed':33B,58B 'filter':30B 'host':21B 'id':50B 'imag':59B 'log':43B 'logged-in':42B 'privat':53B 'privileg':29B 'read':52B 'rebuild':18B,22B 'scope':57B 'self':20B 'self-host':19B 'sequenti':49B 'step':47B 'team':56B 'team-scop':55B 'version':23B","search_c":"'4.5.3':65C 'attach':109C 'attack':84C 'authent':83C 'author':68C 'bypass':69C 'check':82C 'comment':96C,111C 'comments-list':95C 'contain':66C 'content':107C 'detail':93C 'endpoint':98C 'enumer':86C 'feed':92C,106C 'feeds-detail':91C 'feedshelper.checkreadable':81C 'feedslistcontrol':72C 'fetchcom':75C 'fetchdetail':73C 'filter':79C 'id':88C 'imag':108C 'list':97C 'privat':101C 'privileg':78C 'read':100C 'rebuild':63C 'scope':105C 'sequenti':87C 'skip':77C 'team':104C 'team-scop':103C 'via':89C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125372","severity":null,"published_at":"2026-11-10T00:17:09+00:00","modified_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null}],"documents":[{"id":111521,"url":"https://github.com/getrebuild/rebuild/commit/03959a464164e12e87443c689043ceccf56044f3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111522,"url":"https://github.com/getrebuild/rebuild/releases/tag/4.5.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111523,"url":"https://www.vulncheck.com/advisories/rebuild-before-4.5.3-authorization-bypass-via-feeds-details-and-comments-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}