CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2023-27591
High (7.5) in miniflux project miniflux. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in miniflux.app/v2 2.0.43.
Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default). A patch is available in Miniflux 2.0.43. As a workaround, set `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-200, CWE-1220
- Published
- Modified
- Record from
- the NVD, synced
Affected
- miniflux_project:miniflux
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3qjf-qh38-x73v | Go | miniflux.app/v2 | <2.0.43 | 2.0.43 |
| GHSA-3qjf-qh38-x73v | Go | miniflux.app | <=1.0.46 | no fix published |