Feedbin contains an authentication failure that allows attackers to send unauthenticated GET requests to /api/v2/entries/:id/text, bypassing the authorization filter that normally prevents access to private content. The endpoint returns the plain‑text body of any entry identified by an integer ID, so an attacker who can iteratively increment IDs can recover all private newsletter contents, saved pages, and articles from other users' private subscriptions. This leads to a breach of confidentiality for private data. The issue is identified as CWE-306, representing a missing authentication for a critical function.

Affected software is the Feedbin web application, including any release that has not yet incorporated the fix that follows commit 04b89b84189e4727ea19d84ea4a44015859b29cc. Users running older versions up through the commit identified as 739884a are vulnerable. The vendor has provided a patch within the referenced commit to restore proper authorization checks on the entries API.

The CVSS score of 8.7 categorizes this as high severity. EPSS is below 1%, indicating low expected exploitation probability at present, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack path is simple: an unauthenticated attacker can enumerate entry IDs and retrieve the content without credentials. Because the vector relies solely on a missing authentication check, exploitation requires no privileged access or other conditions, making it technically straightforward.