CVE-2026-125376 VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125376?
CVE-2026-125376 is a medium-severity vulnerability in Mereithhh vanblog, published on 9 Nov 2026.
Official description
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles lacking an effective password, or request hidden articles, since getByIdWithPassword never checks the hidden flag, exposing full article content.
Weakness: CWE-863
Which versions are affected by CVE-2026-125376?
How do I fix CVE-2026-125376?
No fix has been published for CVE-2026-125376 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125376 being exploited?
There is no known exploitation of CVE-2026-125376 in the wild and no public exploit code.
Sources
Also known as GHSA-7q7r-9wvx-j8cq.