---
id: CVE-2026-65319
title: >-
  Feedbin Unauthenticated Entry Content Disclosure via GET
  /api/v2/entries/:id/text
summary: >-
  Feedbin (commit 739884a) contains an unauthenticated information disclosure
  vulnerability that allows unauthenticated attackers to retrieve private
  article content by sending requests to the entries text API endpoint, which
  skips the aut…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: Feedbin
product: Feedbin
affected:
  - Feedbin <= 739884a
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-22T15:07:45.734418Z'
exploitAvailable: true
published: '2026-07-21'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:18:19.997Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-65319'
references:
  - url: 'https://github.com/geo-chen/oss/blob/main/feedbin.md'
    label: Public Disclosure
  - url: >-
      https://github.com/feedbin/feedbin/commit/04b89b84189e4727ea19d84ea4a44015859b29cc
    label: Patch Commit
  - url: 'https://github.com/feedbin/feedbin'
    label: Product
  - url: >-
      https://www.vulncheck.com/advisories/feedbin-unauthenticated-entry-content-disclosure-via-get-api-v2-entries-id-text
tags:
  - cve.org
  - exploit-available
epss: 0.00506
epssPercentile: 0.40571
ingestedAt: '2026-09-24T15:45:56.719Z'
---

## Overview

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterate sequential integer entry IDs through the GET /api/v2/entries/:id/text endpoint to enumerate and extract plain-text content of all stored articles, including private newsletter content, personal page-saves, and articles from any user's private subscriptions.

## Affected

- `Feedbin <= 739884a`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.