VANBLOG · CVE-2026-125376 · Package
NO FIX YET
VanBlog, a self-hosted blog, exposes private and hidden articles through its public article endpoint. An unauthenticated attacker can read full article content by submitting any non-empty password or requesting a hidden article by ID.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
VanBlog instances at version 0.54.0 or earlier are affected, through the public POST /api/public/article/:id endpoint. Sites that keep no private or hidden articles, or that sit behind an access gate that blocks public API calls, have less exposure. The sources do not state a fixed version beyond a patch link.
Not affected if auth-gated-api, no-private-articles
Who cares blog, self-hosted, vanblog
POST /api/public/article/:id on a hidden or private article with any non-empty password and see whether the full content is returned.No fix yet, per the sources.
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.