{"schema":"threatline.record/2","record":{"id":"CVE-2026-117562","aliases":[],"summary":"rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint","details":"rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.","categories":["Unclassified"],"product":"rssant","vendor":"anyant","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117562","source_modified_at":"2026-10-27T13:07:56.982Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"rssant","vendor":"anyant","versions":[{"status":"affected","version":"1.9.0","lessThanOrEqual":"1.9.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T13:07:56.982Z","modified_at":"2026-10-27T13:07:56.982Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-117562","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T13:07:56.982Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/anyant/rssant/issues/155","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/anyant/rssant","tags":["product"]},{"source":"CVE List","url":"https://github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47b","tags":["patch"]},{"source":"CVE List","url":"https://github.com/anyant/rssant/blob/v1.9.1/rssant_api/models/union_story.py#L197-L200","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/rssant-1.9.0-through-1.9.1-information-disclosure-via-publish-story-get-endpoint","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T13:07:56.982Z","content_hash":"b26edf03bbef725745919adf222d020929c0474e2d0437fe7eb031e6c3b6374b"}}