GitHub Advisoryadvisory · Go
GHSA-3qjf-qh38-x73v Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics
HIGH
Official page ↗
- Aliases
- CVE-2023-27591
- Ecosystem
- Go
- Packages
- miniflux.app/v2, miniflux.app
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-1220, CWE-200
- Reviewed
- 2025-04-02
Affected packages
• Go miniflux.app/v2: < 2.0.43 → fixed in 2.0.43
• Go miniflux.app: <= 1.0.46 (no fix yet)
Description
Impact
An unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETWORKS` is set to `127.0.0.1/8` (the default).
Patches
PR #1745 fixes the problem. Available in Miniflux >= 2.0.43.
Workarounds
Set `METRICS_COLLECTOR` to `false` (default) or run Miniflux behind a trusted reverse-proxy.
References
• https://miniflux.app/docs/configuration.html#metrics-collector
• https://miniflux.app/docs/configuration.html#metrics-allowed-networks
Related
Alias · CVE (1)
- CVE-2023-27591 Miniflux is a feed reader. vulnerability
References
- https://github.com/miniflux/v2/security/advisories/GHSA-3qjf-qh38-x73v web
- https://nvd.nist.gov/vuln/detail/CVE-2023-27591 advisory
- https://github.com/miniflux/v2/pull/1745 web
- https://github.com/miniflux/v2 package
- https://github.com/miniflux/v2/releases/tag/2.0.43 web
- https://miniflux.app/docs/configuration.html#metrics-collector web