CVE-2026-128331 Miniflux before 2.3.5 Password Change Without Current Password via Settings Form
MediumCVSS 6.0
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| miniflux.app/v2 | < 2.3.5 | 2.3.5 |
| debian/miniflux(Debian:13) | All versions | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.10-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.11-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.12-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.13-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.16-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.16-2 | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.19-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.19-2 | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.6-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.2.6-2 | No fix listed |
| debian/miniflux(Debian:13) | = 2.3.0-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.3.2-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.3.3-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.3.4-1 | No fix listed |
| debian/miniflux(Debian:13) | = 2.3.5-1 | No fix listed |
| debian/miniflux(Debian:14) | < 2.3.5-1 | 2.3.5-1 |
| debian/miniflux(Debian:14) | = 2.2.10-1 | No fix listed |
| debian/miniflux(Debian:14) | = 2.2.11-1 | No fix listed |
| debian/miniflux(Debian:14) | = 2.2.12-1 | No fix listed |
| debian/miniflux(Debian:14) | = 2.2.13-1 | No fix listed |
| debian/miniflux(Debian:14) | = 2.2.16-1 | No fix listed |
| debian/miniflux(Debian:14) | = 2.2.16-2 | No fix listed |
| debian/miniflux(Debian:14) | = 2.2.19-1 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/miniflux(Debian:14) | = 2.2.19-2 | No fix listed |
| debian/miniflux(Debian:14) | = 2.2.6-1 | No fix listed |
| debian/miniflux(Debian:14) | = 2.2.6-2 | No fix listed |
| debian/miniflux(Debian:14) | = 2.3.0-1 | No fix listed |
| debian/miniflux(Debian:14) | = 2.3.2-1 | No fix listed |
| debian/miniflux(Debian:14) | = 2.3.3-1 | No fix listed |
| debian/miniflux(Debian:14) | = 2.3.4-1 | No fix listed |
References
- GitHub Security Advisory (GHSA-ch38-3q93-fwg8) vendor-advisory
- github.com patch
- github.com issue-tracking patch
- miniflux v2.3.5 Release Notes release-notes
- github.com technical-description
- github.com technical-description
- VulnCheck Advisory: Miniflux before 2.3.5 Password Change Without Current Password via Settings Form third-party-advisory
- Debian Security Tracker CVE-2026-128331 vendor-advisory