Wallabag Holds More Than Saved Pages

Wallabag Holds More Than Saved Pages. Wallabag stores articles, account details, API clients, and optional paywall credentials. An internet-facing reader can be a small service with a meaningful data set: saved pages may include internal documents, research notes, or links that reveal organizational interests.

Wallabag 不仅仅存储已保存的页面。Wallabag 会存储文章、账户详情、API 客户端以及可选的付费墙凭据。一个面向互联网的阅读器可能是一个小型服务，但却包含有意义的数据集：已保存的页面可能包含内部文档、研究笔记或揭示组织利益的链接。

Query result: On 2026-10-30, ZoomEye count-only queries used sub_type=all, page 1, and page size 1. app=“Wallabag” returned 0. title=“Wallabag” returned 1,544. The app query did not match the selected fingerprint. The title result is a separate observation and may include login pages and other branded pages. It does not prove that any instance has sharing enabled or that a user’s saved content is public.

查询结果：在 2026 年 10 月 30 日，ZoomEye 的仅计数查询使用了 sub_type=all、第 1 页和页面大小 1。app=“Wallabag” 返回 0。title=“Wallabag” 返回 1,544。应用查询未匹配到所选指纹。标题结果是一项单独的观察，可能包含登录页面和其他品牌页面。这并不能证明任何实例启用了共享，也不能证明用户的已保存内容是公开的。

Account and sharing controls: Wallabag’s user documentation describes two-factor authentication and notes that administrators must enable the feature in the configuration before users can activate it. This is an application-level prerequisite. An organization that assumes every user has MFA should verify the instance setting and the per-user enrollment state. The internal settings documentation describes privacy-related controls, including public sharing of articles. Review who can enable sharing and how a shared page can be revoked. Test with a disposable article and an unauthenticated browser. Confirm that a later revocation removes access, including from a cached direct URL where the application supports it.

账户与共享控制：Wallabag 的用户文档描述了双重身份验证，并指出管理员必须先在配置中启用该功能，用户才能激活它。这是一个应用层面的先决条件。假设每个用户都拥有 MFA 的组织应验证实例设置和每个用户的注册状态。内部设置文档描述了与隐私相关的控制，包括文章的公开共享。审查谁可以启用共享以及如何撤销共享页面。使用一次性文章和未经身份验证的浏览器进行测试。确认后续的撤销操作会移除访问权限，包括在应用程序支持的情况下从缓存的直接 URL 中移除访问权限。

Paywall credentials are especially sensitive. Wallabag’s restricted-access documentation describes optional credentials for sites that require authentication. That credential store should not be readable by every user or by a database backup process with broader access than necessary. Rotate a test credential and confirm that the old value fails.

付费墙凭据尤其敏感。Wallabag 的受限访问文档描述了针对需要身份验证的站点的可选凭据。该凭据存储不应被每个用户或具有超出必要访问权限的数据库备份进程读取。轮换测试凭据并确认旧值失效。

API clients: The user interface includes a place to manage API clients used by mobile apps and integrations. Each client should map to a known user and have a revocation path. A token saved in a phone backup or a browser extension is still part of the account boundary. Review old clients after a device change. Remove a client that no longer has an owner. Test an API request after revocation. Keep OAuth access-token lifetime in mind when investigating a report of continued access. An issue dated after a token was issued does not automatically mean the old token was still valid at that time; the server logs need to show the actual session.

API 客户端：用户界面包含一个用于管理移动应用和集成所使用的 API 客户端的地方。每个客户端都应映射到一个已知用户，并具有撤销路径。保存在手机备份或浏览器扩展中的令牌仍然是账户边界的一部分。在更换设备后审查旧客户端。移除不再拥有所有者的客户端。在撤销后测试 API 请求。在调查持续访问的报告时，请记住 OAuth 访问令牌的生命周期。在令牌颁发日期之后出现的问题并不自动意味着旧令牌在当时仍然有效；服务器日志需要显示实际的会话。

Network and backup checks: Find the public hostname and any alternate port or internal alias. The main login page may be protected by a proxy while the API route bypasses it. Test both with and without the expected session. Check backup storage. Wallabag can use SQLite or another database, and the installation documentation describes database configuration parameters. The backup should be protected by the same access policy as the live data, including encryption and retention. A public title match can identify a possible instance; it cannot reveal whether an old backup sits beside it.

网络与备份检查：查找公共主机名以及任何备用端口或内部别名。主登录页面可能受到代理保护，而 API 路由则绕过它。在有和没有预期会话的情况下进行测试。检查备份存储。Wallabag 可以使用 SQLite 或其他数据库，安装文档描述了数据库配置参数。备份应受到与实时数据相同的访问策略保护，包括加密和保留。公共标题匹配可以识别可能的实例；它无法揭示旧备份是否位于其旁边。

A focused review: Record the owned instances, version, MFA setting, sharing policy, API clients, and paywall credential ownership. Then test one legitimate share, one revoked share, one disabled user, and one revoked token. The result should show which controls fail closed and which rely on an operator remembering to change a setting. The count is only an inventory clue. The security work is the smaller set of tests that connect a saved page to the person who should still be able to read it.

重点审查：记录拥有的实例、版本、MFA 设置、共享策略、API 客户端和付费墙凭据所有权。然后测试一次合法共享、一次撤销共享、一个禁用用户和一个撤销令牌。结果应显示哪些控制措施在失败时保持关闭状态，哪些依赖于操作员记得更改设置。计数仅是库存线索。安全工作是连接已保存页面与仍应有权阅读该页面的人员的一系列较小的测试。