rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.storyget endpoint. Because UnionStory.getbyfeedoffset ignores the onlypublish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.