CVE-2026-128331

Name of the Vulnerable Software and Affected Versions Miniflux versions prior to 2.3.5

Description An unverified password change issue allows users with an active signed-in session to modify the account password without providing the current one. An attacker possessing a stolen session cookie or access to an unattended device can submit new password fields through the updateSettings endpoint to lock out the legitimate owner and take over the account.

Recommendations Update to version 2.3.5 or later.