CVE-2023-27591: high-severity vulnerability in miniflux v2
Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An unauthenticated attacker can access Prometheus metrics on Miniflux instances that have metrics collection enabled, even when they should only be available locally. This exposes sensitive information about the application's internal performance and state.
CVE-2023-27591 exploits improper network validation in Miniflux's metrics endpoint, allowing unauthenticated access to Prometheus metrics despite METRICS_ALLOWED_NETWORKS restrictions (CWE-1220, CWE-200). The vulnerability affects versions prior to 2.0.43 when METRICS_COLLECTOR is enabled; the attacker gains unauthorized information disclosure about application internals without authentication.
In the same product, most dangerous first.