Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck

CVE-2026-117562rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in rssant from anyant. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 74.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.

Affected products (as reported)

Vendor	Product	Versions
anyant	rssant	1.9.0 – through 1.9.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Issue #155 issue-tracking
https://github.com/anyant/rssant product
https://github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47b patch
https://github.com/anyant/rssant/blob/v1.9.1/rssant_api/models/union_story.py#L197-L200 technical-description
VulnCheck Advisory: rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint third-party-advisory