Description
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| miniflux | miniflux | < 2.3.5 | 2.3.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | miniflux | 2.3.5-1 | — |
| Debian 13 | miniflux | No fix yet | — |
References
- GitHub Security Advisory (GHSA-ch38-3q93-fwg8) vendor-advisory
- https://github.com/miniflux/v2/commit/f654f7c7675e5c4cbd6ef5bb5858aa8d9bdf2af1 patch
- https://github.com/miniflux/v2/pull/4596 issue-tracking patch
- miniflux v2.3.5 Release Notes release-notes
- https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/settings_update.go#L19-L98 technical-description
- https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/form/settings.go#L126-L128 technical-description
- VulnCheck Advisory: Miniflux before 2.3.5 Password Change Without Current Password via Settings Form third-party-advisory