CVE-2026-128331

EUVD-2026-125046
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.03%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
miniflux_projectminiflux
𝑥
< 2.3.5
CNA
Common Weakness Enumeration
References
https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/form/settings.go#L126-L128
https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/settings_update.go#L19-L98
https://github.com/miniflux/v2/commit/f654f7c7675e5c4cbd6ef5bb5858aa8d9bdf2af1
https://github.com/miniflux/v2/pull/4596
https://github.com/miniflux/v2/releases/tag/v2.3.5
https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8
https://www.vulncheck.com/advisories/miniflux-before-2.3.5-password-change-without-current-password-via-settings-form