CVE-2026-104388: Missing Authorization in Blubrry Podcasting PowerPress Podcasting

This vulnerability in Blubrry Podcasting PowerPress Podcasting is due to missing authorization controls, which enables unauthorized users to retrieve embedded sensitive data. The affected versions include all releases prior to 11.17.11. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and limited confidentiality impact. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

An attacker can remotely retrieve embedded sensitive data without authentication, potentially exposing confidential information. The impact is limited to confidentiality loss; integrity and availability are not affected. The vulnerability does not require user interaction or privileges, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates and consider restricting access to the affected PowerPress Podcasting versions until a fix is available.