Authorization Bypass Vulnerability in rssant by Anyant
CVE-2026-117562
6.9MEDIUM
What is CVE-2026-117562?
The rssant product versions 1.9.0 and 1.9.1 have a serious authorization bypass vulnerability. This flaw allows attackers without authentication to access unpublished stories through the publish.story_get endpoint. The issue arises because the method UnionStory.get_by_feed_offset doesn't properly enforce the only_publish flag. Consequently, this oversight enables attackers to enumerate feed IDs and offsets, effectively exposing private stories from feeds intended to be confidential. Users of rssant are advised to review and apply the available patches to secure their systems.
Affected Version(s)
rssant 1.9.0 <= 1.9.1