---
id: CVE-2026-117562
title: >-
  rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get
  Endpoint
summary: >-
  rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that
  allows unauthenticated attackers to read stories from unpublished feeds
  through the anonymous publish.story_get endpoint. Because
  UnionStory.get_by_feed_offse…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: anyant
product: rssant
affected:
  - rssant >= 1.9.0 <= 1.9.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-02T15:57:47.805556Z'
published: '2026-10-27'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T15:58:02.117Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117562'
references:
  - url: 'https://github.com/anyant/rssant/issues/155'
    label: 'GitHub Issue #155'
  - url: 'https://github.com/anyant/rssant'
  - url: >-
      https://github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47b
  - url: >-
      https://github.com/anyant/rssant/blob/v1.9.1/rssant_api/models/union_story.py#L197-L200
  - url: >-
      https://www.vulncheck.com/advisories/rssant-1.9.0-through-1.9.1-information-disclosure-via-publish-story-get-endpoint
    label: >-
      VulnCheck Advisory: rssant 1.9.0 through 1.9.1 Information Disclosure via
      publish.story_get Endpoint
tags:
  - cve.org
epss: 0.00323
epssPercentile: 0.25392
ingestedAt: '2026-10-27T16:11:59.333Z'
---

## Overview

rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.

## Affected

- `rssant >= 1.9.0 <= 1.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.