Go/miniflux.app/v2 CVE-2023-27591: high 7.5, EPSS 0.76%

Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics

Action: Upgrade miniflux.app/v2 to 2.0.43 or later.

go get miniflux.app/v2@v2.0.43

Affected

Fixed versions

Sources

• osv: GHSA-3qjf-qh38-x73v
• https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v
• https://nvd.nist.gov/vuln/detail/CVE-2023-27591
• https://github.com/miniflux/v2/pull/1745
• https://github.com/miniflux/v2
• https://github.com/miniflux/v2/releases/tag/2.0.43
• https://miniflux.app/docs/configuration.html#metrics-collector

CVE-2023-27591 · published 2025-04-02T17:24:11Z · modified 2026-09-10T03:50:57.049458040Z · JSON