CVE-2026-117562

MEDIUM 5.3

rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.

CWE	CWE-639
Vendor	anyant
Product	rssant
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for anyant rssant

Be the first to know when new medium vulnerabilities affecting anyant rssant are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

anyant / rssant

1.9.0 ≤ 1.9.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/anyant/rssant/issues/155 github.com: https://github.com/anyant/rssant github.com: https://github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47b github.com: https://github.com/anyant/rssant/blob/v1.9.1/rssant_api/models/union_story.py#L197-L200 vulncheck.com: https://www.vulncheck.com/advisories/rssant-1.9.0-through-1.9.1-information-disclosure-via-publish-story-get-endpoint

Credits

hieuPenguinnn