CVE-2026-117562 Details
Description
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.
An authorization bypass vulnerability has been identified in rssant versions 1.9.0 through 1.9.1. This vulnerability allows unauthenticated attackers to access stories from unpublished feeds via the anonymous publish.story_get endpoint. The issue arises because the UnionStory.get_by_feed_offset method fails to consider the only_publish flag, enabling attackers to enumerate feed IDs and offsets to retrieve stories from private feeds.
Users can update to rssant version 1.9.2, which addresses this vulnerability by restoring the proper authorization checks. After updating, verify that the publish.story_get endpoint no longer allows access to unpublished feed stories.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/anyant/rssant | [email protected] | Vendor |
| https://github.com/anyant/rssant/blob/v1.9.1/rssant_api/models/union_story.py#L197-L200 | [email protected] | Source CodeVendor |
| https://github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47b | [email protected] | Source CodeVendor |
| https://github.com/anyant/rssant/issues/155 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/rssant-1.9.0-through-1.9.1-information-disclosure-via-publish-story-get-endpoint | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| anyant rssant | >= 1.9.0, <= 1.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |