---
id: "CVE-2026-125372"
page: "https://infrastack.ai/live/CVE-2026-125372"
kind: "vulnerability"
aliases: ["CVE-2026-125372"]
title: "REBUILD: authenticated users read private feed content by changing IDs"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "rebuild", "self-hosted"]
not_affected_if: ["version-4.5.3-or-later"]
published_at: "2026-11-10T00:17:09+00:00"
first_seen_at: "2026-11-10T00:28:42+00:00"
updated_at: "2026-11-10T00:30:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125372", "first_seen_at": "2026-11-10T00:28:42+00:00"}]
exploit_sources: []
---

# REBUILD: authenticated users read private feed content by changing IDs

Link for people: https://infrastack.ai/live/CVE-2026-125372 (this .md is for agents)

REBUILD versions before 4.5.3 fail to apply privilege filtering in the feed details and comments endpoints. An attacker with a logged-in account can step through sequential IDs to read private or team-scoped feeds, images, attachments and comments.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REBUILD version; versions before `4.5.3` are affected.
- Review whether `FeedsListController` `fetchDetails` and `fetchComments` are reachable by ordinary user accounts.

## Fix

- REBUILD: upgrade to `4.5.3` or later.

## Timeline

- 2026-11-10T00:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125372

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/rebuild-before-4.5.3-authorization-bypass-via-feeds-details-and-comments-endpoints
- [fix] Patch: github.com https://github.com/getrebuild/rebuild/commit/03959a464164e12e87443c689043ceccf56044f3
- [fix] Release notes: github.com https://github.com/getrebuild/rebuild/releases/tag/4.5.3

## From the sources

REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_