CVE-2026-50105

MediumCVSS 4.3

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

RSS/Atom feed handlers bypass API-token scope and public-only confinement, due to an incomplete fix of issue #37698.

Risk Assessment

Users with limited-scope tokens may gain access to data or functionality they should not have, potentially leading to confidentiality or integrity breaches.

Recommendation

Apply a complete fix that enforces token scope and public-only restrictions in all RSS/Atom handlers. Test scenarios with various token scopes.

Original NVD description (English source)

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)