CVE-2026-117562: rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.storyget endpoint. Because UnionStory.getbyfeedoffset ignores the onlypublish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. No credentials or user interaction are required.
What information can be exposed?
Attackers can read stories belonging to unpublished feeds. They can enumerate feed IDs and offsets through the anonymous publish.story_get endpoint to retrieve those stories.
Which installations are affected?
rssant versions 1.9.0 through 1.9.1 are affected. The vulnerable behavior is present in the anonymous publish.story_get endpoint.
How can I determine whether private stories may already have been accessible?
Check whether the deployment ran rssant 1.9.0 or 1.9.1 and exposed the anonymous publish.story_get endpoint. Review available access logs for requests to that endpoint, particularly requests that vary feed IDs and offsets.