getrebuild rebuild vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 5.3CVE-2026-125372EPSS 0.3%2026-11-10

   REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential…

2. 5.3CVE-2026-111667EPSS 0.3%2026-10-16

   REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id o…

3. 6.0CVE-2026-110611EPSS 0.4%2026-10-14

   REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid…

4. 9.8CVE-2025-50900EPSS 0.7%2025-08-25

   An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affected function is preHandle In the filter code, use CodecUtils.urlDecode(request.getRequestURI()) to o…

5. 5.1CVE-2024-46413EPSS 0.3%2025-08-25

   Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBStoreController#loadDataIndex method.

6. 9.1CVE-2024-25294EPSS 0.8%2024-03-20

   An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload,URL parameters.

7. 4.3CVE-2023-2474EPSS 0.4%2023-05-02

   A vulnerability has been found in Rebuild 3.2 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclose…