{"id":"CVE-2023-27591","aliases":["GHSA-3qjf-qh38-x73v"],"title":"Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics","summary":"Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"v2","product":"miniflux.app/v2","ecosystem":"go","affected":["miniflux.app/v2 < 2.0.43","miniflux.app <= 1.0.46"],"patched":["miniflux.app/v2 2.0.43"],"published":"2025-04-02","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:57.049458040Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3qjf-qh38-x73v","references":[{"url":"https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27591"},{"url":"https://github.com/miniflux/v2/pull/1745"},{"url":"https://github.com/miniflux/v2"},{"url":"https://github.com/miniflux/v2/releases/tag/2.0.43"},{"url":"https://miniflux.app/docs/configuration.html#metrics-collector"}],"tags":["osv","go"],"epss":0.00755,"epssPercentile":0.53644,"ingestedAt":"2026-09-12T03:13:01.749Z","slug":"CVE-2023-27591","body":"## Overview\n\n### Impact\n\nAn unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` [configuration option](https://miniflux.app/docs/configuration.html#metrics-collector) is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default).\n\n### Patches\n\nPR #1745 fixes the problem. Available in Miniflux >= 2.0.43.\n\n### Workarounds\n\nSet `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.\n\n### References\n\n- https://miniflux.app/docs/configuration.html#metrics-collector\n- https://miniflux.app/docs/configuration.html#metrics-allowed-networks\n\n## Affected packages\n\n- `miniflux.app/v2 < 2.0.43`\n- `miniflux.app <= 1.0.46`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `miniflux.app/v2 2.0.43`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}