CVE-2026-117562
rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint
anyant rssant
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.
Text from CVE List
Affected versions 1
- rssantaffected: 1.9.0 through 1.9.1CVE List
References 5
- github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47bFixvia CVE List
- vulncheck.com/advisories/rssant-1.9.0-through-1.9.1-information-disclosure-via-publish-story-get-endpointAdvisoryvia CVE List
- github.com/anyant/rssant/issues/155Referencevia CVE List
- github.com/anyant/rssantReferencevia CVE List
- github.com/anyant/rssant/blob/v1.9.1/rssant_api/models/union_story.py#L197-L200Referencevia CVE List