CVE-2026-56772 is an authorization bypass vulnerability in samuelclay's NewsBlur before version 14.5.0. Authenticated users can supply arbitrary user_id parameters to the GET /social/interactions endpoint, which lacks proper ownership verification. This flaw allows attackers to enumerate user IDs and read private notification feeds belonging to other users, exposing social interactions such as follows and replies without authorization.

An attacker with valid authentication can access private social activity data of other users by exploiting the lack of access control verification on the user_id parameter. This leads to unauthorized disclosure of private notification feeds, potentially compromising user privacy and social interaction confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the affected endpoint where possible and consider limiting user_id parameter inputs to authorized values.