The vulnerability presents a bypass of authorization in the FeedsListController fetchDetails and fetchComments methods, which skips privilege filtering and the FeedsHelper.checkReadable checks. This allows an authenticated attacker to read private or team‑scoped feed content, including images, attachments, and comments, leading to exposure of confidential information. The weakness is an example of CWE‑639: Authorization Bypass Through User-Controlled Key.

GetRebuild REBUILD versions prior to 4.5.3 are affected. The vulnerability exists in the feeds‑details and comments‑list endpoints and enables enumeration of sequential feed IDs.

The CVSS score of 5.3 classifies the issue as medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. However, because the flaw requires authenticated access, the attack surface is limited to legitimate user credentials. An attacker who gains valid credentials can enumerate feed IDs to retrieve sensitive data via the exposed endpoints.