CVE-2026-117562

Medium

Description

rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.

SeverityMedium

CVSS5.3

Exploit probability—

ProductAnyant Rssant

PublishedOct 27, 2026

First seenOct 27, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Patches

github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47b

Affected products

Product	Affected versions	Fixed in
anyant rssant	1.9.0 ≤ v ≤ 1.9.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.