Live › vulnerability › CVE-2026-117562
Go to dashboardrssant 1.9.0 through 1.9.1 has an authorization bypass in the anonymous publish.story_get endpoint. Unauthenticated attackers can enumerate feed IDs and offsets to read stories from feeds that were never published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams running rssant 1.9.0 through 1.9.1 that expose the publish.story_get endpoint to the internet or a shared network. The sources do not say whether the default configuration exposes it. Deployments that do not run these versions can skip it.
No product ranges from the sources yet.
pip show rssant and see whether it falls in 1.9.0 through 1.9.1.publish.story_get endpoint in the deployment.1.9.1; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.
This page as .md · .json · in your agent: get_signal("CVE-2026-117562")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.