CVE-2026-117562— rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint

Quick assessment

Affected

anyant rssant

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

rssant 1.9.0 至 1.9.1 版本存在一个授权绕过漏洞，允许未认证的攻击者通过匿名接口读取未发布动态中的内容。由于方法忽略了标志，攻击者可以通过枚举动态流（feed）ID 和偏移量（offset）来检索私有的动态流内容。

CVSS 5.3 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint

Source: CVE Program / CVE List V5

Vulnerability Description

rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
anyant	rssant	1.9.0 ~ 1.9.1	-

II. Public POCs for CVE-2026-117562

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117562

请登录查看更多情报信息。

Other References for CVE-2026-117562 (5)

https://github.com/anyant/rssant/blob/v1.9.1/rssant_api/models/union_story.py#L197-L200 technical-description
https://github.com/anyant/rssant/commit/b65336f1414a32a50670ee2ba7e87cb38e0ad47b patch
https://github.com/anyant/rssant product
https://github.com/anyant/rssant/issues/155 issue-tracking
https://www.vulncheck.com/advisories/rssant-1.9.0-through-1.9.1-information-disclosure-via-publish-story-get-endpoint third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117562

IV. Related Vulnerabilities

Same weakness: CWE-639