CVE-2026-128331 · Package
NO FIX YET · SEE WHAT TO DO
Miniflux, a self-hosted RSS reader, lets a signed-in session change the account password without entering the current one. An attacker with a stolen session cookie or access to an unattended signed-in browser can set a new password and lock the owner out.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Miniflux before 2.3.5 are exposed, since anyone with a valid signed-in session can change the password. Hosted or managed Miniflux setups are affected only if the provider runs a vulnerable version. Exposure requires a stolen session cookie or an unattended signed-in browser, so shared or public devices carry more risk.
Not affected if no-shared-devices, version-2.3.5-or-later
Who cares go, miniflux, self-hosted
miniflux -version or the version shown in the web interface footer2.3.52.3.5 or laterMiniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.