CVE-2026-117562 in rssant
Summary
by MITRE • 10/27/2026
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publish flag, attackers can enumerate feed IDs and offsets to retrieve private feed stories.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The rssant software versions 1.9.0 through 1.9.1 contain a critical authorization bypass vulnerability that stems from improper access control mechanisms within its API endpoints. This flaw specifically affects the anonymous publish.story_get endpoint, which is designed to retrieve story content based on feed identifiers and offset parameters. The core technical failure lies in the UnionStory.get_by_feed_offset function, which fails to enforce or check the only_publish flag during data retrieval operations. In a properly secured system, this flag should restrict access to stories that are explicitly marked for public consumption, thereby preventing unauthorized users from accessing content intended for private or unpublished feeds. Because this validation is missing, any unauthenticated attacker can interact with the endpoint without providing valid credentials or tokens.
This architectural oversight allows attackers to perform systematic enumeration of feed identifiers and offset values. By iterating through potential feed IDs and adjusting offsets, an adversary can retrieve stories that were never meant to be public. The impact extends beyond simple data leakage; it compromises the confidentiality integrity model by exposing sensitive information contained within unpublished feeds. These feeds may contain draft articles, internal communications, or proprietary content that organizations rely on for operational security. The ability to enumerate and access these resources without authentication represents a significant breach of trust in the application's permission structure.
From an industry standards perspective, this vulnerability aligns with CWE-285 Improper Authorization, as the system fails to enforce proper authorization controls when accessing user-controlled data. It also relates to CWE-601 URL Redirection to Untrusted Site or Open Redirect if the feed IDs are derived from unvalidated inputs, though the primary issue is the lack of access control checks. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1537 Transfer Data to Cloud Account via Web Service and potentially T1087 Account Discovery, as attackers can discover valid feed structures through enumeration. The exploitation technique involves passive reconnaissance followed by direct data exfiltration using standard HTTP requests against the vulnerable endpoint.
To mitigate this vulnerability, developers must immediately patch rssant to version 1.9.2 or later where these access control checks have been implemented. For systems that cannot be patched instantly, temporary mitigations include restricting network-level access to the affected API endpoints via firewall rules or reverse proxy configurations. Implementing strict input validation and ensuring that all data retrieval functions explicitly check for publication status before returning results is essential. Additionally, enabling comprehensive logging on these endpoints can help detect ongoing enumeration attempts by monitoring for high-frequency requests with varying feed IDs and offsets. Regular security audits focusing on authorization logic in API handlers are recommended to prevent similar flaws from persisting in future releases.