CVE-2026-125376

EUVD-2026-120539
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 22.99%
Common Weakness Enumeration
References
https://github.com/Mereithhh/vanblog
https://github.com/Mereithhh/vanblog/blob/8eb670b88e05572fd3c6039a89759abb6745dcab/packages/server/src/provider/article/article.provider.ts#L751-L780
https://github.com/Mereithhh/vanblog/commit/81b868f4d568c8accff62b9c35d0e556d1e7970d
https://github.com/Mereithhh/vanblog/issues/611
https://www.vulncheck.com/advisories/vanblog-through-0.54.0-private-article-disclosure-via-public-password-endpoint