omnivore-app Omnivore Subscription index.ts scanFeedsResolver url information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, has been found in omnivore-app Omnivore. The impacted element is the function scanFeedsResolver of the file packages/api/src/resolvers/subscriptions/index.ts of the component Subscription. The manipulation of the argument url leads to information disclosure. This vulnerability is listed as CVE-2026-77066. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in omnivore-app Omnivore (affected version unknown). This issue affects the function scanFeedsResolver of the file packages/api/src/resolvers/subscriptions/index.ts of the component Subscription. The manipulation of the argument url with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and createPageSaveRequest applies the same check, so the omission is specific to this resolver. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields, so disclosure is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-77066 since 08/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Applying the patch c4d7d8562e6b9aabb1d8e4dabca268e314baa43a is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• omnivore-app

Name

• Omnivore

Website

• Product: https://github.com/omnivore-app/omnivore/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion