CVE-2026-56772 describes a broken access control vulnerability in NewsBlur before version 14.5.0. The issue arises because the GET /social/interactions endpoint accepts user_id parameters from authenticated users without verifying ownership. This flaw allows attackers to enumerate user_id values and access private social interaction data of other users, including follows and replies, without proper authorization. The vulnerability is classified as medium severity with a CVSS 4.0 base score of 5.3. No official patch or remediation level has been documented yet, and no known exploits are reported in the wild.

An authenticated user can bypass access controls to view private notification feeds and social activity of other users by manipulating the user_id parameter. This leads to unauthorized disclosure of potentially sensitive social interaction information, violating user privacy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint where possible and monitor for suspicious activity related to user_id enumeration. Avoid exposing user_id parameters in requests without proper authorization checks.